[dns-operations] anchors.atlas.ripe.net/ripe.net - DNSSEC bogus due expiration

[Paul de Weerd]

Dear Matthew,

On 01/11/2023 12:13, Matthew Richardson via dns-operations wrote:
> Our systems use some RIPE Atlas anchors for general connectivity
> monitoring.  Just now, they all failed.
> 
> If looks as if DNSSEC has expired:-
> 
> https://dnsviz.net/d/anchors.atlas.ripe.net/dnssec/
> 
> It also looks as if other things in ripe.net may also have expired (eg
> www.ripe.net  when looking for a contact to advise of this).

Indeed, there was an issue with the DNSSEC signatures on the ripe.net 
zone expiring earlier today (20231101104448).  As Stephane commented, 
this was resolved at 12:15 (UTC) on our end, but as usual it may take 
some time for the fixed zone to propagate to all caches.

We are working on a post mortem about this incident and will share that 
with the community ASAP.

For future reference, in case of issues with the ripe.net services, 
https://status.ripe.net/ should be the go-to place.  Admittedly, with 
the ripe.net zone bogus, that was also unavailable - something more to 
consider going forward.

Best regards,

Paul de Weerd
Manager Global Information Infrastructure team
RIPE NCC