This archive is retained to ensure existing URLs remain functional. It will not contain any emails sent to this mailing list after July 1, 2024. For all messages, including those sent before and after this date, please visit the new location of the archive at https://mailman.ripe.net/archives/list/dns-wg@ripe.net/

[dns-wg] DNSSEC validation problem with ripe.net

Next message (by thread): [dns-wg] Next Online DNS WG meeting - 9 December

Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Anand Buddhdev anandb at ripe.net
Fri Dec 4 14:57:14 CET 2020

Dear colleagues,

On 3 December, at around 15:40 (UTC+1), Matt Nordhoff and Peter van Dijk
alerted us to a problem with the DNS resolution of certain names in
ripe.net. Upon investigation, we discovered that a recent update in the
zone had changed the status of some address records to glue records.
This change was not handled correctly by our DNSSEC signer, and it left
spurious NSEC records in the zone, which then caused validation failures.

Eventually, around 20:00 (UTC+1), we forced the DNSSEC signer to fully
re-sign the zone, and this fixed the problem. We have reported this
issue to the developers of the DNSSEC signing software, and they are
investigating. We are also adding some extra monitoring to our
infrastructure, to detect such problems more quickly.

Regards,
Anand Buddhdev
RIPE NCC

Next message (by thread): [dns-wg] Next Online DNS WG meeting - 9 December

Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

[ dns-wg Archives ]