Urgent: .al DNSSEC validation failure causing SERVFAIL on validating resolvers

[Jonas Dichelle]

Hello,

We are seeing widespread DNSSEC validation failures for .al domains from major validating resolvers.

IANA shows the .al root DS as:

26319 13 2 a6974512ccbff7610b03ef7b68150dcafc7f8df4640d619e0020d7532a175d03

Observed on 2026-07-03 around 14:41 UTC:

dig @1.1.1.1 superlumin.al A
=> SERVFAIL
=> EDE: DNSKEY Missing / no SEP matching the DS found for al
=> EDE: failed to verify signatures for superlumin.al opt-out proof / RRSIG NSEC

dig @8.8.8.8 superlumin.al A
=> SERVFAIL

dig @9.9.9.9 superlumin.al A
=> SERVFAIL / DNSSEC Bogus

With DNSSEC checking disabled, the same name resolves:

dig @1.1.1.1 +cdflag superlumin.al A
=> NOERROR, A records returned

This appears to affect multiple .al domains, including akep.al itself from some resolver locations. Recovery appears uneven by resolver/network.

Could you please escalate this to .al registry DNS operations and verify the .al DNSSEC DS/DNSKEY/RRSIG/NSEC signing state?

Affected domain example:
superlumin.al

Best Regards,
Jonas | Founder

The Superluminal Computing Corporation
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20260703/41c7c758/attachment.html>