news.volyx.in

DNSSEC disruption affecting .de domains – Resolved (status.denic.de)

747 points by warpspin · 70 days ago · 411 comments on HN

Article summary

A DNSSEC disruption affected .de domains, causing some websites to become unreachable. The issue appeared to be related to a DNSSEC validation failure, with some resolvers refusing to answer due to a malformed signature. The problem was likely caused by a configuration mistake during a scheduled maintenance event. The disruption had a significant impact, with many prominent .de domains becoming inaccessible.

Main themes

  • DNSSEC disruption
  • Domain name system
  • Internet infrastructure
  • Security protocols
  • Centralization risks
  • Decentralized alternatives

What commenters say

  • The DNSSEC disruption was likely caused by a configuration mistake during a scheduled maintenance event, highlighting the importance of thorough testing and review.
  • The use of fail-closed protocols like DNSSEC can introduce brittleness into the internet infrastructure, making it more vulnerable to disruptions.
  • Some argue that the benefits of security protocols like DNSSEC outweigh the risks of brittleness, while others believe that more robust and fault-tolerant systems are needed.
  • The disruption highlights the risks of centralization in the domain name system, with some arguing that decentralized alternatives like blockchain-based solutions could provide greater resilience.
  • The incident also raises concerns about the reliability of critical internet infrastructure, with some pointing out that a failure of services like Let's Encrypt could have even more far-reaching consequences.
  • There is a need for more robust and fault-tolerant systems, as well as greater awareness of the risks and limitations of current infrastructure, to prevent similar disruptions in the future.
  • Decentralized alternatives to traditional DNS may offer a solution to the centralization risks, but they currently lack widespread support and mindshare.
  • The importance of monitoring and maintaining internet infrastructure, including certificate expiration and DNS configuration, cannot be overstated to prevent similar disruptions.