<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="caret-color: rgb(0, 0, 0)">I'll leave it to Vincent/Afnic to answer on this more extensively once there is more clarity, but we noticed it as well a few hours ago for dnsbelgium.fr .</div>
<div style="caret-color: rgb(0, 0, 0)">Mail + text message has been sent to Vincent and his colleagues at the time, they were looking into it.</div>
<div style="caret-color: rgb(0, 0, 0)">I've been in contact with him again ~30 min ago, to be sure he knew.</div>
<div style="caret-color: rgb(0, 0, 0)">They're aware; and working on it, would let them work on the issue at this phase instead of tracking the various channels.</div>
<div style="caret-color: rgb(0, 0, 0)"><br>
</div>
<div style="caret-color: rgb(0, 0, 0)">Br,</div>
<div style="caret-color: rgb(0, 0, 0)"><br>
</div>
<div style="caret-color: rgb(0, 0, 0)">Thomas</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> dns-operations <dns-operations-bounces@dns-oarc.net> on behalf of Viktor Dukhovni <ietf-dane@dukhovni.org><br>
<b>Sent:</b> Monday, May 4, 2020 10:23 PM<br>
<b>To:</b> dns-operations@dns-oarc.net <dns-operations@dns-oarc.net><br>
<b>Subject:</b> Re: [dns-operations] DNSSEC Signatures failed in Top-Level Domain fr.</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On Mon, May 04, 2020 at 04:01:41PM -0400, Viktor Dukhovni wrote:<br>
> On Mon, May 04, 2020 at 09:35:26PM +0200, Martin Wismer wrote:<br>
> <br>
> > I noticed, that the DNSSEC signed Domains under top-Level Domain fr. <br>
> > failed since about 4 hours.<br>
> <br>
> Indeed, there does seem to be a problem with expired DS RR signatures.<br>
> A random sample of 1000 .fr child domains (out of 398,564 total known<br>
> to me signed .fr domains) returns DS lookup ServFail for 205 of them.<br>
> <br>
> The associated RRSIG expiration times are:<br>
> <br>
> 204 20200504145605<br>
> 1 20200504174835<br>
<br>
All 205 expired DS RRsets from the initial sample now have a DS RRSIG<br>
with an expiration time of 20200703184136 (retrieved directly from<br>
authoritative .FR servers). So it looks like progress is being made to<br>
resolve this.<br>
<br>
-- <br>
Viktor.<br>
_______________________________________________<br>
dns-operations mailing list<br>
dns-operations@lists.dns-oarc.net<br>
<a href="https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.dns-oarc.net%2Fmailman%2Flistinfo%2Fdns-operations&data=02%7C01%7Cthomas.dupas%40dnsbelgium.be%7C73c713e6576e4139ef1f08d7f06a7c1f%7C695195dec0cb447892042a861e60e59c%7C0%7C0%7C637242212694976449&sdata=3JArEIAOPrXR%2BvtgoP5NchrATDpF%2BQYo5OM7Dzc6wXY%3D&reserved=0">https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.dns-oarc.net%2Fmailman%2Flistinfo%2Fdns-operations&data=02%7C01%7Cthomas.dupas%40dnsbelgium.be%7C73c713e6576e4139ef1f08d7f06a7c1f%7C695195dec0cb447892042a861e60e59c%7C0%7C0%7C637242212694976449&sdata=3JArEIAOPrXR%2BvtgoP5NchrATDpF%2BQYo5OM7Dzc6wXY%3D&reserved=0</a><br>
</div>
</span></font></div>
</body>
</html>