A DNS root server (c.root-servers.net), one of 13 that ensure the operation of the root DNS zone (the starting link in the domain name resolution chain, providing information about DNS servers serving top-level domains and the keys for their verification using DNSSEC), was out of sync with other root DNS servers for four days. The root DNS server 'C' (192.33.4.12) is supported by 12 servers located in different countries. All these servers, from May 18 to 22, did not reflect changes in the root zone, served outdated data, and were not synchronized with the rest of the DNS root infrastructure.
During this period, no changes were made to the root zone, but work was planned to update the DNSSEC digital signature for the top-level domain '.gov', conducted as part of the transition to cryptographic keys based on the ECDSA algorithm. Recently, algorithms 8 (RSA/SHA-256) and 13 (ECDSA P-256/SHA-256) have been used for securing the '.gov' zone in DNSSEC, but algorithm 8 remains active. During the weekend, it was planned to add a DS record for algorithm 13 to the root zone, after which the process of removing the DS record for algorithm 8 would start. A similar replacement was also planned for the '.int' domain. As a result, the DS records associated with supporting algorithm 13 for the root were transferred to IANA but were never published, as the key replacement process was paused after issues were identified until the situation with root server 'C' was clarified. szerverek The operation of the root DNS server 'C' is provided under agreements with the corporation ICANN by the Tier 1 backbone provider Cogent Communications, represented in 53 countries. A few days before the incident, access issues were noted from the Cogent Communications network to 1575 autonomous systems due to the cessation of peering with the Indian Tier 1 provider Tata Communications.
The operation of the root DNS server 'C' is ensured based on agreements with ICANN by the Tier 1 backbone provider Cogent Communications, available in 53 countries. Several days before the incident, problems accessing 1575 autonomous systems were noted from the Cogent Communications network due to the termination of peering with the Indian Tier 1 provider Tata Communications.
A root DNS zone update cessation was attributed to a failure in the monitoring system responsible for tracking changes. The failure occurred after a routing change that was not related to the operation of DNS servers (detailed information about the causes is not yet provided). Apart from the desynchronization, no violations in processing requests to the root DNS server 'C' have been recorded. Synchronization was fully restored on May 22 at 7 PM (MSK). Among the potential issues that could arise during the prolonged desynchronization, the possibility of issuing outdated data about keys used in DNSSEC and the addresses of DNS servers servicing domainok the first level.
Forrás: opennet.ru
