Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • .de TLD is online. DNS working fine

    DNSSEC not working

    If using an open resolver, i.e., a shared DNS cache, e.g., third party DNS service such as Google, Cloudflare, etc., then it might fail, or it might not. It depends on the third party DNS provider

    https://datatracker.ietf.org/meeting/118/materials/slides-11...

    by 1vuio0pswjnm7
  • To me, a response from a "root DNS server", i.e., [a-m].root-servers.net, is not "wrong" if it contains the correct data that I'm requesting, e.g., domainnames and associated IP numbers

    I'm never requesting RRSIGs as I do not use that data. For me, it's just cruft that now comes in the response

    by 1vuio0pswjnm7
  • DNS worked fine. The responses that the root DNS servers were sending were wrong.

    It's the cryptographic version of that one time the same TLD told the world domains starting with certain letters didn't exist: https://www.theregister.com/2010/05/12/germany_top_level_dom...

    by jeroenhd
  • Finally establishing the concept of Feiertag on the internet. Come back tomorrow.
    by __michaelg
  • Internetfreie Dienstage, 21st century variant of Autofreie Sonntage.
    by throw1234567891
  • I just spent the better half of an hour to debug unbound and the pihole because I thought it's a me problem...

    Good news though, if you add domain-insecure: "de" to your unbound config everything works fine

    by kuerbel
  • Same haha
    by victorbjorklund
  • SAMEEEEE !!!
    by chromehearts
  • Just before the outage happened I updated multiple client servers. That was a very stressfull hour trying to figure out why nothing works.
    by V__
  • I don't even enable DNSSEC in Unbound. There just isn't enough adoption yet for me to feel like I am missing out on something, yet.

    "Cloudflare Radar data shows 8.11% of domains are signed with DNSSEC, but only 0.47% of queries are validated end-to-end." [1]

    Zones I may care about:

    - Amazon.com: unsigned

    - My banks: unsigned

    - Hacker News: unsigned

    - Email that I do not host: unsigned

    - My power companies billing: unsigned

    - I found some! id.me and irs.gov are signed.

    [1] - https://technologychecker.io/blog/dnssec-adoption

    by Bender
  • I have never used DNSSEC and never really bothered implementing it, but do I understand it correctly that we took the decentralized platform DNS was and added a single-point-of-failure certificate layer on top of it which now breaks because the central organisation managing this certificate has an outage taking basically all domains with them?
    by tom1337
  • What you see here is decentralisation working. The issue is with the operator of the de TLD, and as such only that TLD is affected. DNS is not decentralised in such a way, that multiple organisations run the infrastructure of a TLD, those are always run by a single entity.(.com and .net are operated by Verisign)

    So what the issue is, that the operator has, does not change the impact.

    by Medowar
  • DNSSEC doesn't change the degree to which DNS is decentralized. It's always been hierarchical. In the absence of caching, every DNS query starts with a request to the root DNS servers. For foo.com or foo.de, you first need to query the root servers to determine the nameservers responsible for .com and .de. Then you contact the .com or .de servers to ask for the foo.com and foo.de nameservers. All DNSSEC does is add signatures to these responses, and adds public keys so you can authenticate responses the next level down.

    A list of root nameserver IP addresses is included with every local recursive DNS resolver. The list changes, albeit slowly, over the years. With DNSSEC, this list also includes public keys of those root servers, which also rotate, slowly.

    by wahern
  • > which now breaks because the central organisation managing this certificate has an outage

    The ".de" TLD is inherently managed by a single organization, and things wouldn't be much better if its nameservers went down. Some of the records would be cached by downstream resolvers, but not all of them, and not for very long.

    > we took the decentralized platform DNS was and added a single-point-of-failure certificate layer on top of it

    DNSSEC actually makes DNS more decentralized: without DNSSEC, the only way to guarantee a trustworthy response is to directly ask the authoritative nameservers. But with DNSSEC, you can query third-party caching resolvers and still be able to trust the response because only a legitimate answer will have a valid signature.

    Similarly, without DNSSEC, a domain owner needs to absolutely trust its authoritative nameservers, since they can trivially forge trusted results. But with DNSSEC, you don't need to trust your authoritative nameservers nearly as much [0], meaning that you can safely host some of them with third-parties.

    [0]: https://news.ycombinator.com/item?id=47409728

    by gucci-on-fleek
  • https://status.denic.de/ says "Partial Service Disruption" for DNS Nameservice now.

    EDIT: it says "Service Disruption" now

    by sunaookami
  • "All Systems Operational"
    by cubefox
  • It says "Server Not Found" now
    by niklasrde
  • At least they have some humor left.

    Edit: Now even the humor is gone.

    by MASNeo
  • Whole Germany is offline. DENIC: "Partial Service Disruption". That's one way to phrase it.
    by gruselhaus
  • Even when every site in the world’s 3rd biggest economy goes down it’s still just a ‘Partial’ service disruption :D
    by port3000
  • Crazy. I can't remember an incident like this ever happened before and it's still not fixed? .de is probably the most important unrestricted domain after .com from an economical perspective. Millions of businesses are "down".
    by siva7
  • Well it was already very late in the day (21-22?) so the impact was not big I would say
    by carstenhag
  • Germany isn't as big as you think.
    by HDBaseT
  • Must have been mid 2000s. Root dns servers were down. Super hard to diagnose the issues it causes on your side because it "never happens".
    by dizhn
  • There's a good index of major DNSSEC outages here, https://ianix.com/pub/dnssec-outages.html
    by 8organicbits
  • It's Germany, pessimistic time estimation + 1/3 and you are in a realistic time frame for the issue being resolved.
    by lschueller
  • DENIC apparently resolved all .de domains to NXDOMAIN in 2010: https://www.theregister.com/2010/05/12/germany_top_level_dom...
    by AndroTux
  • I remember when .com went down, in July 1997.

    https://archive.nytimes.com/www.nytimes.com/library/cyber/we...

    by rwmj
  • I was STRESSING tf out because I wasn't able to connect to my services & apps through my domains like at all .. they only work when using my phone data ? .. thank god it's not my fault this time
    by chromehearts
  • But we're Germans, and we need someone to blame.
    by Locke80