[dns-operations] anchors.atlas.ripe.net/ripe.net - DNSSEC bogus due expiration

[Mark Andrews]

It shouldn’t take any time as the bogus records shouldn’t have been cached.

-- 
Mark Andrews

> On 1 Nov 2023, at 15:06, Paul de Weerd <pdeweerd at ripe.net> wrote:
> 
> Dear Matthew,
> 
>> On 01/11/2023 12:13, Matthew Richardson via dns-operations wrote:
>> Our systems use some RIPE Atlas anchors for general connectivity
>> monitoring.  Just now, they all failed.
>> If looks as if DNSSEC has expired:-
>> https://dnsviz.net/d/anchors.atlas.ripe.net/dnssec/
>> It also looks as if other things in ripe.net may also have expired (eg
>> www.ripe.net  when looking for a contact to advise of this).
> 
> Indeed, there was an issue with the DNSSEC signatures on the ripe.net zone expiring earlier today (20231101104448).  As Stephane commented, this was resolved at 12:15 (UTC) on our end, but as usual it may take some time for the fixed zone to propagate to all caches.
> 
> We are working on a post mortem about this incident and will share that with the community ASAP.
> 
> For future reference, in case of issues with the ripe.net services, https://status.ripe.net/ should be the go-to place.  Admittedly, with the ripe.net zone bogus, that was also unavailable - something more to consider going forward.
> 
> Best regards,
> 
> Paul de Weerd
> Manager Global Information Infrastructure team
> RIPE NCC
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations