Post #2072728
2026-05-05 21:21 UTC
[ DNSSEC Bone Crunching Noises ]
Seemingly the actual sigs that were made do not validate:
RRSIG denic.de/DS alg 8, id 33834: The cryptographic signature of the RRSIG RR does not properly validate. See RFC 4035, Sec. 5.3.3.
Replies (1)
-
@marius@kiessling.social 2026-05-05 21:33
@benjojo what’s a bit concerning is this current update: „DENIC eG is currently experiencing a disruption in its DNS service for .de domains. As a result, all DNSSEC-signed .de domains are currently affected in their reachability.“ That’s actually downplaying the impact. All DNSSEC-verifying resolvers cannot resolve DE domains. Even non-signed zones are affected.