Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

161–170 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#161

Post by AndroTux »

Medowar wrote: post #123
tom1337 wrote: post #116

I have never used DNSSEC and never really bothered implementing it, but do I understand it correctly that we took the decentralized platform DNS was and added a single-point-of-failure certificate layer on top of it which now breaks because the central organisation managing this certificate has an outage taking basically all domains with them?

What you see here is decentralisation working. The issue is with the operator of the de TLD, and as such only that TLD is affected. DNS is not decentralised in such a way, that multiple organisations run the infrastructure of a TLD, those are always run by a single entity.(.com and .net are operated by Verisign) So what the issue is, that the operator has, does not change the impact.

What if the root (.) certificate breaks?

Re: DNSSEC disruption affecting .de domains – Resolved

#162

Post by silisili »

hannob wrote: post #133
walrus01 wrote: post #128

Earlier quoted context omitted.

To be fair, advanced real world knowledge of public/private key PKIs (x.509 or other), things like root CAs, are a fairly esoteric and very specialized field of study. There's people whose regular day jobs are nothing but doing stuff with PKI infrastructure and their depth of knowledge on many other non-PKI subjects is probably surface level only.

I know quite a bit about PKI and X.509, and I can tell you that much: the overlap with how DNSSEC works is limited.

As is the overlap between DNSSEC and DNS itself, to be honest.

I once worked at the level of administering DNSSEC for 300+ TLDs. It's its own world. When that company was winding down, I tried to continue in the field but the most common response (outside of no response, of course), was 'we already have a DNS team/vendor/guy.' And well, then things like this happen. I won't throw stones though, it's a lot to learn and can be incredibly brittle.

Re: DNSSEC disruption affecting .de domains – Resolved

#163

Post by icedchai »

dlopes7 wrote: post #124
krystofbe wrote: post #7

Looks like a DNSSEC issue, not a nameserver outage. Validating resolvers SERVFAIL on every .de name with EDE: RRSIG with malformed signature found for a0d5d1p51kijsevll74k523htmq406bk.de/nsec3 (keytag=33834) dig +cd amazon.de @8.8.8.8 works, dig amazon.de @a.nic.de works. Zone data is intact, DENIC just published an RRSIG over an NSEC3 record that doesn't validate against ZSK 33834. Every validating resolver therefor…

I love how I work with IT for 20 years and don't understand a single acronym here other than DNSSEC

I've been in IT 30+ years, been running DNS, web servers, etc. since at least 1994. I haven't bothered with DNSSEC due to perceived operational complexity. The penalty for a screw up, a total outage, just doesn't seem worth the security it provides.

Re: DNSSEC disruption affecting .de domains – Resolved

#165

Post by bflesch »

dlopes7 wrote: post #124
krystofbe wrote: post #7

Looks like a DNSSEC issue, not a nameserver outage. Validating resolvers SERVFAIL on every .de name with EDE: RRSIG with malformed signature found for a0d5d1p51kijsevll74k523htmq406bk.de/nsec3 (keytag=33834) dig +cd amazon.de @8.8.8.8 works, dig amazon.de @a.nic.de works. Zone data is intact, DENIC just published an RRSIG over an NSEC3 record that doesn't validate against ZSK 33834. Every validating resolver therefor…

I love how I work with IT for 20 years and don't understand a single acronym here other than DNSSEC

Don't worry, that's by design ;)

Re: DNSSEC disruption affecting .de domains – Resolved

#167

Post by londons_explore »

ricardo81 wrote: post #60
notpushkin wrote: post #33

Earlier quoted context omitted.

{"data":{"error":"Imgur is temporarily over capacity. Please try again later."},"success":false,"status":403} There is some strange irony to this, I suppose.

I get "content not viewable in your region", from the UK. Not an ideal image sharing website nowadays.

Other countries are available. With a UK passport you can move to Ireland, Thailand, or Australia fairly easily, amongst others.

Re: DNSSEC disruption affecting .de domains – Resolved

#168

Post by pocksuppet »

qazwsxedchac wrote: post #111
krystofbe wrote: post #7

Looks like a DNSSEC issue, not a nameserver outage. Validating resolvers SERVFAIL on every .de name with EDE: RRSIG with malformed signature found for a0d5d1p51kijsevll74k523htmq406bk.de/nsec3 (keytag=33834) dig +cd amazon.de @8.8.8.8 works, dig amazon.de @a.nic.de works. Zone data is intact, DENIC just published an RRSIG over an NSEC3 record that doesn't validate against ZSK 33834. Every validating resolver therefor…

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

DNS is a centralization risk, yes. Somehow we've decided this is fine. DNSSEC isn't the only issue - your TLD's nameservers could also be offline, or censored in your country.
Post reply on HN