<![CDATA[It seems]]>It seems .de is having DNSSEC (and potentially other) issues because nic.de is having issues, which appears to host all their root nameservers. I wish the nic.de peoples much hugs and good luck.

I wonder what implications this has for other critical infra that may now suddenly be getting DNS failures. I hope it doesn't cascade.

It really goes to show how fragile the internet is. which is scary given how much we've come to rely on it.

I think we need more backup infra. meshtastic/etc?

Link Preview Image
]]>https://board.circlewithadot.net/topic/66c99912-20fc-4406-8766-19fc07b65a7e/it-seemsRSS for NodeFri, 15 May 2026 05:19:09 GMTTue, 05 May 2026 21:24:02 GMT60<![CDATA[Reply to It seems on Fri, 08 May 2026 18:04:19 GMT]]>@anthropy
So far they have this:
https://blog.denic.de/en/analysis-of-the-dns-outage-on-5-may-2026/

]]>https://board.circlewithadot.net/post/https://critter.cafe/users/PileOfOxides/statuses/116540274107093808https://board.circlewithadot.net/post/https://critter.cafe/users/PileOfOxides/statuses/116540274107093808Fri, 08 May 2026 18:04:19 GMT<![CDATA[Reply to It seems on Fri, 08 May 2026 16:37:01 GMT]]>did.. anyone ever hear what the root cause was of the denic root dns outage? they just kinda removed their status page and I can't find much more about it, it'd be interesting to know, even if I can imagine it's uncomfortable for them to share

]]>https://board.circlewithadot.net/post/https://mastodon.derg.nz/users/anthropy/statuses/116539930810027935https://board.circlewithadot.net/post/https://mastodon.derg.nz/users/anthropy/statuses/116539930810027935Fri, 08 May 2026 16:37:01 GMT<![CDATA[Reply to It seems on Wed, 06 May 2026 00:05:41 GMT]]>@anthropy some intern who missed patching copyfail on one of the servers is sweating bullets right now.

]]>https://board.circlewithadot.net/post/https://his.macer.life/ap/users/115645684013106018/statuses/116524708074056664https://board.circlewithadot.net/post/https://his.macer.life/ap/users/115645684013106018/statuses/116524708074056664Wed, 06 May 2026 00:05:41 GMT<![CDATA[Reply to It seems on Tue, 05 May 2026 22:04:22 GMT]]>@anthropy The resolver validates DNSSEC for all the zones in the chain.
So for www.sebastians-site.de it first checks .de then the zone sebastian-site and www is just a A record in that zone. sebastian-site does not have DNSSEC enabled. Never got around to figuring that out.
However the de zone pointing the validating resolver to the name server that has the sebastians-site zone, has it's DNSSEC messed up. So the resolver can not trust anything in the .de zone and stops there.

See https://dnsviz.net/d/sebastians-site.de/dnssec/

]]>https://board.circlewithadot.net/post/https://schottkydio.de/users/sebastian/statuses/01KQX2QEDA9CPPC337J5TRQRTEhttps://board.circlewithadot.net/post/https://schottkydio.de/users/sebastian/statuses/01KQX2QEDA9CPPC337J5TRQRTETue, 05 May 2026 22:04:22 GMT<![CDATA[Reply to It seems on Tue, 05 May 2026 21:47:24 GMT]]>@anthropy This sounds ... very bad... I thought they had to either rollback an update or deploy certs

]]>https://board.circlewithadot.net/post/https://gnurfl.de/users/Erik/statuses/116524164325541929https://board.circlewithadot.net/post/https://gnurfl.de/users/Erik/statuses/116524164325541929Tue, 05 May 2026 21:47:24 GMT<![CDATA[Reply to It seems on Tue, 05 May 2026 21:47:20 GMT]]>@sebastian yea I was actually about to update the message heh, it makes sense, though some people reported issues beyond dnssec domains, but I suspect those were just secretly actually dnssec-enabled

]]>https://board.circlewithadot.net/post/https://mastodon.derg.nz/users/anthropy/statuses/116524164092125749https://board.circlewithadot.net/post/https://mastodon.derg.nz/users/anthropy/statuses/116524164092125749Tue, 05 May 2026 21:47:20 GMT<![CDATA[Reply to It seems on Tue, 05 May 2026 21:45:47 GMT]]>@anthropy It is just a DNSSEC thing. As far as I have debugged it on my setup every validating resolver (that is every DNS server that actually checks the DNSSEC stuff before replying to you) stumbles upon the broken stuff for .de and returns servfail instead.

]]>https://board.circlewithadot.net/post/https://schottkydio.de/users/sebastian/statuses/01KQX1NCX7ARBCH1C681W73QG0https://board.circlewithadot.net/post/https://schottkydio.de/users/sebastian/statuses/01KQX1NCX7ARBCH1C681W73QG0Tue, 05 May 2026 21:45:47 GMT<![CDATA[Reply to It seems on Tue, 05 May 2026 21:36:16 GMT]]>text from status.denic.de (their official statuspage) is saying that they're still investigating and haven't fully identified the root cause yet.

Link Preview Image
]]>https://board.circlewithadot.net/post/https://mastodon.derg.nz/users/anthropy/statuses/116524120546488231https://board.circlewithadot.net/post/https://mastodon.derg.nz/users/anthropy/statuses/116524120546488231Tue, 05 May 2026 21:36:16 GMT<![CDATA[Reply to It seems on Tue, 05 May 2026 21:26:54 GMT]]>note that from what I heard it *should* just be DNSSEC related issues, but as far as I can tell entire domains are down, like google.de and amazon.de are completely unreachable even for me.

edit: it makes sense for domains that use DNSSEC to not reply anything right now. All properly configured domains will have issues as such, whereas non-DNSSEC domains should still be fine (although some people reported issues there too- but I suspect they're all actually DNSSEC-enabled)

Link Preview ImageLink Preview Image
]]>https://board.circlewithadot.net/post/https://mastodon.derg.nz/users/anthropy/statuses/116524083736052820https://board.circlewithadot.net/post/https://mastodon.derg.nz/users/anthropy/statuses/116524083736052820Tue, 05 May 2026 21:26:54 GMT