Another Entry in the "Stuff Im Glad Im Not Responsible for" Ledger
7 days ago
- On July 3, 2026, a broken DNSSEC key rollover by the Albanian operator AKEP caused validation failures for the .al TLD, making sites unreachable for validating resolvers like Cloudflare's 1.1.1.1.
- Cloudflare implemented a Negative Trust Anchor (NTA) to temporarily suspend DNSSEC validation and restore resolution, similar to a previous .de incident, but NTAs previously lacked transparency about bypassed validation.
- During the .al incident, 1.1.1.1 introduced a new Extended DNS Error (EDE) code (EDE 33) to signal when an NTA is applied, providing clients with visibility that DNSSEC validation was bypassed.
- The incident highlights that TLD-level DNSSEC failures can affect all domains under that TLD, and EDE 33 helps close the transparency gap by informing users when responses are not DNSSEC-validated.
- The EDE 33 code is part of an Internet-Draft submitted to the IETF DNSOP Working Group, with support from tools like kdig, aiming to standardize disclosure of NTAs in DNS responses.