On Sat, Nov 07, 2015 at 01:29:48PM -0800, Glen wrote:
> I apologize for the noise and confusion. Mr Dukhovni did not address
> his email to the IETF list; however, he did send his email with a
> manually-configured Reply-to: header set to the list. I should have
> noticed that when replying.
>
> At any rate, DNS for the IRTF is not down, it does appear to be
> functioning correctly, and other test sites confirm it. The site
> referenced in Mr. Dukhovni's email, dataviz.net, appeared to have been
> caching old results.
For the record, the dnsviz.net results were quite fresh, and all
the nameservers except the master were returing "bogus" results
with expired signatures. With 5 out of 6 nameservers in that state,
most DNS lookups were failing for any validating stub or recursive
nameservers.
Dnsviz links and associated timestamps for the outage are:
http://dnsviz.net/d/irtf.org/VjpVPA/dnssec/ 2015-11-04 18:58:04 UTC
http://dnsviz.net/d/irtf.org/VjqI6g/dnssec/ 2015-11-04 22:38:34 UTC
http://dnsviz.net/d/irtf.org/Vjr5Wg/dnssec/ 2015-11-05 06:38:18 UTC
http://dnsviz.net/d/irtf.org/VjtpxA/dnssec/ 2015-11-05 14:37:56 UTC
http://dnsviz.net/d/irtf.org/VjvaWw/dnssec/ 2015-11-05 22:38:19 UTC
http://dnsviz.net/d/irtf.org/VjxKwA/dnssec/ 2015-11-06 06:37:52 UTC
http://dnsviz.net/d/irtf.org/Vjy7Yg/dnssec/ 2015-11-06 14:38:26 UTC
http://dnsviz.net/d/irtf.org/Vj0rxA/dnssec/ 2015-11-06 22:37:56 UTC
http://dnsviz.net/d/irtf.org/Vj2cYQ/dnssec/ 2015-11-07 06:38:25 UTC
http://dnsviz.net/d/irtf.org/Vj4MxQ/dnssec/ 2015-11-07 14:37:57 UTC
http://dnsviz.net/d/irtf.org/Vj5ihg/dnssec/ 2015-11-07 20:43:50 UTC
with only the master nameserver showing valid signatures at those times.
After the zone refresh:
http://dnsviz.net/d/irtf.org/Vj5rsA/dnssec/
the timestamp is "2015-11-07 21:22:56 UTC" with all nameservers
showing valid signatures.
If we look back just before the outage then all is well at:
http://dnsviz.net/d/irtf.org/VjnfOA/dnssec/ 2015-11-04 10:34:32 UTC
then the only hint of trouble is a possibly transient problem
fetching the DNSKEY RRset from the master.
Another 8 hours before that:
http://dnsviz.net/d/irtf.org/VjlvmA/dnssec/ 2015-11-04 02:38:16 UTC
all looks well. Though both then and now a 1 year signature validity
feels a bit too long to me. And with re-signing so infrequent, it
is difficult to ensure that it works correctly.
--
Viktor.