DNSSEC caused an outage at work

[dave14305]

Today, for the first time in my lengthy IT career, I witnessed a “production stopping” outage at work due to bad DNSSEC records published by a transportation vendor. SERVFAIL. Still ongoing.

 

[randomName]

Today, for the first time in my lengthy IT career, I witnessed a “production stopping” outage at work due to bad DNSSEC records published by a transportation vendor. SERVFAIL. Still ongoing.

Is that sort of thing a deliberate action or ?

 

[dave14305]

Not sure what it looked like before, but a CNAME was broken.

cyclone3-eu-prod.dhl.com | DNSViz

 

[bbunge]

Related to this?

SSL CA's marked as distrusted - June 2025

Just as a heads up - two more CA's have been marked as distrusted, so things like DoH/DoT/DNSSEC might have issues... 1) Chunghwa Telecom - Taiwan, ROC 2) Netlock - Budapest, Hungary

www.snbforums.com

 

[RMerlin]

Unlikely, DNSSEC does not use SSL certificates.

 

[sfx2000]

good read here...

https://www.cloudflare.com/learning/dns/dnssec/how-dnssec-works/