Post #1253115

2024-05-23 21:23 UTC

@dangoodin "the Internet as we know it could collapse" might be a slight over-dramatisation. - #DNS roots are massively anycast so mostly only Cogent's customers and peers are affected. - root responses are cached for days so the internet is *always* out of sync - by design! - Update delays and caching implications are routinely monitored by dns operators which is why this was noticed. - Many significant domains (apple.com, au.) haven't changed in years, so unaffected.

Replies (1)

@tie@infosec.exchange 2024-05-24 09:38

@markd @dangoodin It is likely happening much more often than people think. In 2023, I had an elusive DNS error on my hands and tracked it down to 2 out of 4 "physical" servers behind 1 out of 13 root server names being out-of-date in a _single_ geography (Japan). Any query hitting the two unfortunate hosts would get out-of-date response, which included an expired DNSSEC signature. With an invalid DNSSEC signature, well-behaved recursive resolvers would throw on the ground any response coming from that server. In other words, DNS resolution was completely broken. Guess what? Almost nobody saw that problem. DNS is so redundant. The query would generally be retried, and then it would hit a healthy root server. Multiple times on the DNS layer, and then potentially more times on the application layer. The rest of the world was oblivious to it, and even in Japan it would have been perceived as connectivity noise. After discovering the issue, I contacted the operators of that root and they resolved it in a few hours. 0 apocalypses took place.

Open ##1253116