Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

431–440 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#431

Post by tharkun__ »

ale42 wrote: post #353
tharkun__ wrote: post #241

Earlier quoted context omitted.

No it doesn't. DNS breaks as soon as TTLs run out. It's your choice to set them so low that stuff breaks immediately.

This assumes that the host name you want has been recently queried. If it's not cached, good luck...

TL;DR: If it's not cached, does it really matter if it's offline for some time?

Long version:

If you're so popular all around that you really really want a very very short TTL, people will query all the time from all the places that "count", won't they? So it's gonna be cached.

If you're not so popular or not all around, what does it matter even if you had a very very short TTL? You're not loosing much.

Re: DNSSEC disruption affecting .de domains – Resolved

#432

Post by londons_explore »

gspr wrote: post #394
londons_explore wrote: post #167

Earlier quoted context omitted.

Other countries are available. With a UK passport you can move to Ireland, Thailand, or Australia fairly easily, amongst others.

Are you seriously suggesting that that's a feasible, go-to solution for a problem in your country? For most normal, well-adjusted people?

Plenty of people leave countries all the time.

In fact, voting with your feet and leaving is far more effective at fixing political issues than the democratic voting process.

Re: DNSSEC disruption affecting .de domains – Resolved

#433

Post by gspr »

londons_explore wrote: post #432
gspr wrote: post #394

Earlier quoted context omitted.

Are you seriously suggesting that that's a feasible, go-to solution for a problem in your country? For most normal, well-adjusted people?

Plenty of people leave countries all the time. In fact, voting with your feet and leaving is far more effective at fixing political issues than the democratic voting process.

> Plenty of people leave countries all the time.

Yes. I've done so myself. The fact that people do this all the time doesn't mean it's the best thing to do when your country has problems.

People also move houses all the time. It's a big undertaking. Not the default solution whenever your kitchen needs renovations.

> In fact, voting with your feet and leaving is far more effective at fixing political issues than the democratic voting process.

Citation needed. Sounds very defeatist.

Re: DNSSEC disruption affecting .de domains – Resolved

#434

Post by wildylion »

walrus01 wrote: post #125
qazwsxedchac wrote: post #111

Earlier quoted context omitted.

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

It looks like a failed key replacement during a scheduled maintenance event. Normally this sort of thing is thoroughly tested and has multiple eyes on for detailed review and planning before changes get committed, but obviously something got missed.

.ru [had this](https://habr.com/ru/news/790214/) in 2024. On the other hand, the russian government in itself had been doing a stellar job at breaking the internet.

(I hope I'll live to see them all sentenced to life without parole)

Re: DNSSEC disruption affecting .de domains – Resolved

#435

Post by efreak »

g4cg54g54 wrote: post #113

funfact: enabling DNS sec NOW will fix your domain instantly if dnssec was disabled before -> no idea if that also "heals" anyone who had dnssec on before. -> no idea if maybe they need to roll back something and then rebreak the new dnssec i made a minute later lol...

I had dnssec enabled from 2018 until 1984 hosting messed it up in 2023 and I had to remove/disable keys from the registrar (oddly no information about this on their website or elsewhere, the issue apparently only exists in emails. Apparently they had an issue with BIND upgrade and it made up new keys...). I thought about reenabling it, but very few people other than me access my server, it has a static IP, and Firefox still doesn't validate dnssec anyways.

Re: DNSSEC disruption affecting .de domains – Resolved

#436

Post by basilikum »

toast0 wrote: post #411
basilikum wrote: post #228

This is the kind of system failure that we need really good and well tested disaster recovery plans for. While not necessary this time, DENIC and any critical infrastructure provider should be able to rebuild their entire infrastructure from scratch in a tolerable amount of time (Rather days than hours in the case of a full rebuild). Importantly the disaster recovery plan has to work without reliance on either the sy…

> This is the kind of system failure that we need really good and well tested disaster recovery plans for. All the cool kids offer their services over multiple TLDs and have their name servers of record in multiple TLDs, too. It's not quite best practices for recursive DNS to regularly fetch the complete root zone to cache it, but it's not unreasonable to do so.

Having nameservers on multiple TLDs is definitely smart. But shouldn't glue address this at least for short outages already? How does the delegating zone handle and cache glue records?

Providing the same site on multiple TLDs is kind of a phishing hazard though. It may make sense for non end user facing APIs and other critical points, but for end user sites I think sites should stick to one domain. Otherwise they train users to fall for phishing sites.

Re: DNSSEC disruption affecting .de domains – Resolved

#437

Post by notpushkin »

londons_explore wrote: post #167
ricardo81 wrote: post #60

Earlier quoted context omitted.

I get "content not viewable in your region", from the UK. Not an ideal image sharing website nowadays.

Other countries are available. With a UK passport you can move to Ireland, Thailand, or Australia fairly easily, amongst others.

FWIW, I’ve got that error while in Thailand :D It resolved in a couple minutes though.

Re: DNSSEC disruption affecting .de domains – Resolved

#438

Post by Tepix »

account42 wrote: post #390
Tepix wrote: post #359

Earlier quoted context omitted.

Bla bla, always easy to rant... https://blog.denic.de/denic-informiert-uber-die-behebung-der... "Die Störung ist inzwischen behoben und alle Systeme laufen wieder stabil. Die genaue Ursache wird derzeit noch analysiert. Sobald belastbare Erkenntnisse vorliegen, wird DENIC diese transparent zur Verfügung stellen." translation: ‘The disruption has now been resolved and all systems are running smoothly again. The exact…

Also always easy to announce "Sobald belastbare Erkenntnisse vorliegen, wird DENIC diese transparent zur Verfügung stellen." and then remain silent until the media forgets about the incident and never actually publish anything.

Sure, but they did publish this two days later:

https://blog.denic.de/analyse-des-dns-ausfalls-vom-5-mai-202...

Sounds like they will post more details later. Maybe this time you'll give them the benefit of the doubt?

Re: DNSSEC disruption affecting .de domains – Resolved

#439

Post by blmaniac »

It seems like DENIC has a problem again. My domain elektro-menne.de is down. I've been debugging this issue for more than an hour, and it seems like the domain exists in WHOIS and Cloudflare responds correctly when queried directly, but DENIC authoritative nameservers return NXDOMAIN.

For example:

dig @a.nic.de elektro-menne.de A

returns NXDOMAIN directly from DENIC.

Zonemaster also reports: "elektro-menne.de does not exist as a DNS zone."

I also found multiple other .de domains currently affected by the exact same issue. Looks like the domains are present in WHOIS, but missing from the live .de DNS zone delegation.

Re: DNSSEC disruption affecting .de domains – Resolved

#440

Post by the8472 »

fc417fc802 wrote: post #287
the8472 wrote: post #160

Earlier quoted context omitted.

fail-closed protocols have introduced some brittleness. A HTTP 1.0 server from 1999 probably still can service visitors today. A HTTPS/TLS 1.0 server from the same year wouldn't.

You're not wrong but objecting to fail-closed in a security sensitive context is entirely missing the point.

Giving up on robustness is capitulation on a social-technical interface. "users can't be trusted, we can't have any fallbacks, ever" is a problem that needs to be solved.
Post reply on HN