Seems up again. How briefly did the outage last?
DNSSEC disruption affecting .de domains – Resolved
321–330 of 440 posts
Re: DNSSEC disruption affecting .de domains – Resolved
#322Re: DNSSEC disruption affecting .de domains – Resolved
#323Cloudflare has now disabled DNSSEC validation on their 1.1.1.1 resolver: https://www.cloudflarestatus.com/incidents/vjrk8c8w37lz
Welp. I think can call it on DNSSEC now.
I doubt it. The root cause of this was a root server misconfiguration or bug. It happened to DNSSEC records this time, which is a pain, but next time it might as well flip bits or point to wrong IP addresses instead.
Paradoxically, resolvers wouldn't have noticed the misconfiguration if it weren't for DNSSEC.
Re: DNSSEC disruption affecting .de domains – Resolved
#324Earlier quoted context omitted.
Danke Merkel
Not sure if serious or /s
Almost certainly /s.
"Danke Merkel" ("Thanks Merkel") was once a sincere criticism from conservatives regarding her policies (esp. during 2015 refugee crisis), but it quickly evolved into a sarcastic, deadpan joke used to blame her for literally anything that goes wrong in daily Germany - even years after she left. Interesting phenomenon...
Re: DNSSEC disruption affecting .de domains – Resolved
#325Earlier quoted context omitted.
Let's Encrypt going down isn't equivalent to a rant about how encryption was a terrible idea from the very beginning and we should all just use unencrypted traffic.
Pretty sure that rant doesn't exist.
It does kinda? at least the part about to much security and it's really funny: https://tom7.org/httpv/httpv.pdf also available as Video on YouTube.
Re: DNSSEC disruption affecting .de domains – Resolved
#326Earlier quoted context omitted.
What do you recommend then? DNS doesn't usually change that often, but if you mess it up when it does, you're in for some pain if TTLs are high!
Not the one you're replying to, but I'd keep TTL high normally and lower it one TTL ahead of a planned change.
This is the way.
Re: DNSSEC disruption affecting .de domains – Resolved
#327.de TLD is online. DNS working fine DNSSEC not working If using an open resolver, i.e., a shared DNS cache, e.g., third party DNS service such as Google, Cloudflare, etc., then it might fail, or it might not. It depends on the third party DNS provider https://datatracker.ietf.org/meeting/118/materials/slides-11...
DNS worked fine. The responses that the root DNS servers were sending were wrong.
It's the cryptographic version of that one time the same TLD told the world domains starting with certain letters didn't exist: https://www.theregister.com/2010/05/12/germany_top_level_dom...
Re: DNSSEC disruption affecting .de domains – Resolved
#328Earlier quoted context omitted.
On Google cloud it's always four nameservers like ns-cloud-c1.googledomains.com ns-cloud-c2.googledomains.com ns-cloud-c3.googledomains.com ns-cloud-c4.googledomains.com Would not make any sense to do four of them if it's a single AZ. Also, they are geo-aware and routed to your nearest region.
Are you conflating autonomous system (AS) with availability zone (AZ)?
Uhh, you're right, I totally did. Now I see the parent's point, thank you.
Re: DNSSEC disruption affecting .de domains – Resolved
#329I've considered hard-coding some addresses into firmware as a fallback for a DNS outtage (which is more likely than not just misconfigured local DNS.) Events like this help justify this approach to the unconcerned.
The irony is that DNS is a global and distributed system meant to be resilient. It’s the DNSSEC layer on top in this case causing problems.
The global and distributed system relies on the system actually returning valid responses. If the root servers are broken, whether it's a problem with RRSIG records or A records, the TLD is broken.
If my domains' DNS servers start pointing at localhost, that doesn't mean DNS is a broken protocol.