.al DNSSEC validation failure causing SERVFAIL on validating resolvers

[Stephane Bortzmeyer]

On Mon, Jul 06, 2026 at 06:47:53PM +0000,
 Paul Hoffman <paul.hoffman at icann.org> wrote 
 a message of 9 lines which said:

> This happened two days ago: see <https://mastodns.net/@diffroot/116857712875727653>

On DNSviz:

When key 26319 was there and worked:
https://dnsviz.net/d/al/akep9Q/dnssec/

When it was replaced by key 5419 (which was not referenced by the DS):
https://dnsviz.net/d/al/akfFWw/dnssec/

When the now-incorrect DS was removed:
https://dnsviz.net/d/al/akgKPA/dnssec/

> (Yes, following DNS stuff on Mastodon is now part of maintaining DNS...)

Yes, this is a recent change: these days, operational information tends
to be more on the fediverse than on Twitter.