.NZ DNSSEC problem

Forums › IT Pro and developers › .NZ DNSSEC problem

MichaelNZ

1354 posts

Uber Geek

Trusted

Integrity Tech Solutions

#201496 21-Aug-2016 13:07

Yesterday I reported an issue to my registrar about DNSSEC records not deleting (I did a key rollover) and also being deleted when Whois information is updated. The response this morning was they have identified an issue at the registry and are working through it with NZRS. I don't have any more details but for obvious reasons I recommend anyone using DNSSEC to check the updates in the Whois until this has been solved, lest your domain become unavailable.

WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers

freitasm

BDFL - Memuneh
79130 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1615081 21-Aug-2016 13:10

If I understand correctly this would affect all NZ registrars since it's a NZRS problem?

Also, does it affect the domain only if you make specific changes (e.g,. contact) or any change (such as renewal)? Is there a pattern?

Mighty Ape

Shop now on Mighty Ape (affiliate link).

MichaelNZ

1354 posts

Uber Geek

Trusted

Integrity Tech Solutions

#1615082 21-Aug-2016 13:14

freitasm:

If I understand correctly this would affect all NZ registrars since it's a NZRS problem?

Also, does it affect the domain only if you make specific changes (e.g,. contact) or any change (such as renewal)? Is there a pattern?

1. I assume so. I was advised there is an issue at the registry. That's all I know.

2. It manifests in 2 ways: a. DNSSEC DS records can be added but not removed. b. Updating Whois contact information results in the existing DS records being removed.

I have no idea if the symptoms are specific to the registrar involved... or whatever... all I know is there is a problem and I advise people using DNSSEC to avoid updates or at minimum to confirm them until this matter is resolved and/or we have further information.

WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers

michaelmurfy

meow
13214 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#1615083 21-Aug-2016 13:22

I've pinged @metaname for a quick comment if there was a problem with NZRS. This could be quite bad for people (like me) who run DNSSEC on multiple domains.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

MichaelNZ

1354 posts

Uber Geek

Trusted

Integrity Tech Solutions

#1615084 21-Aug-2016 13:24

michaelmurfy:

I've pinged @metaname for a quick comment if there was a problem with NZRS. This could be quite bad for people (like me) who run DNSSEC on multiple domains.

I don't think it's a biggie as long as people don't change anything until it's fixed and/or we know what is happening.

WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers

freitasm

BDFL - Memuneh
79130 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1615087 21-Aug-2016 13:31

I have DNSSEC in all my .NZ domains with Metaname and have DNSSEC on any domain I can with GoDaddy. I don't change stuff on the domains but I worry about renewals pretty much.

michaelmurfy

meow
13214 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#1615107 21-Aug-2016 14:24

Just had a response from Metaname saying there is no current issues with the NZRS:

we've never seen an issue like this, the last time that any changes were rolled to the NZSRS was in January and that the same request of the registry API is used to manage both contact details ("Whois information") and to publish or take-down DS records.

Edit: Just noted if this is a new issue they likely have not seen it. I've been unable to replicate the issue on Metaname with one of my domains.

MichaelNZ

1354 posts

Uber Geek

Trusted

Integrity Tech Solutions

#1615109 21-Aug-2016 14:31

we've never seen an
issue like this, the last time that any changes were rolled to the
NZSRS was in January and that the same request of the
registry API is used to manage both contact details ("Whois
information") and to publish or take-down DS records.

One thing I know in this industry is never assume things work the way you want them to and/or how they should. An official response from NZRS would be preferable but statements saying "we haven't seen this before [implied - so it can't happen]" don't add much.

WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers

freitasm

BDFL - Memuneh
79130 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1615111 21-Aug-2016 14:33

Saw this yesterday and it's all true:

This didn't work as expected.

This didn't work, as expected.