DENIC .de DNSSEC outage

DENIC .de DNSSEC outage: a faulty key rollover made all .de domains unresolvable for validating resolvers for more than three hours on 5 May 2026

During a routine, scheduled DNSSEC key rollover on the evening of 2026-05-05, DENIC distributed signatures for the .de zone that validating resolvers could not verify, so they treated responses for all .de domains as bogus (DENIC, 2026-05-06). DENIC dates the incident from 21:57, began distributing a correct zone at 00:08 and had fully restored normal operation by 01:15 on 2026-05-06, giving no time zone; read as CEST, that is 19:57 to 23:15 UTC (DENIC, 2026-05-06); Cloudflare saw SERVFAILs from about 19:30 UTC and rolled out its own mitigation at 22:17 UTC through an existing override rule, having no native negative trust anchor mechanism (Cloudflare, 2026-05-06); heise gives 21:43 for the first disruption, which read as CEST is 19:43 UTC (heise online, 2026-05-08), so the three sources give three onsets. DENIC's analysis traces the fault to in-house code around its hardware security modules in the third-generation signing system it put into operation in April 2026: instead of one key pair stored on three HSMs, the software generated three different key pairs, one per HSM, and only one of them matched the pre-published DNSKEY (DENIC analysis, 2026-05-08). Because signatures over NSEC3 records were also unverifiable, even second-level domains without DNSSEC failed to resolve, and DENIC's three permanent validation tools detected the anomaly but their alerts were not processed correctly (DENIC analysis, 2026-05-08). DENIC's final report of 2026-06-11 confirms that initial analysis, rules out any compromise of the signing system and any malfunction of Knot or the HSMs, and explains that the test environment, a single HSM at one location, did not fully execute the rollover-agent code, which misbehaves only when several HSMs are connected (DENIC final report, 2026-06-11).