EDE 33: Signaling DNSSEC Bypass in DNS Responses
- Source
- blog.cloudflare.com
- Author
- Sebastiaan Neuteboom
- Date
Context
Cloudflare's 1.1.1.1 resolver can now explicitly report when it has suspended DNSSEC checks to keep a domain reachable. DNSSEC verifies the authenticity of domain-name answers; broken signing arrangements can cause a validating resolver to reject them. A temporary exception called a Negative Trust Anchor allows resolution to continue without that verification.
The incident account describes using an Extended DNS Error code, EDE 33, during the July 3, 2026 outage of Albania's .al domain to identify responses covered by such an exception. This gives monitoring software a specific explanation for the bypass. It signals the resolver's decision; it does not repair the signing failure or restore cryptographic protection.
- The break was a mismatch, not an attack: .al published a new signing key and withdrew the old one while the root zone's fingerprint still pointed at the old key id, so every validating resolver found no matching key and failed.
- Cloudflare could not reach the registry to report it, because the operator's contact addresses were themselves .al domains — unreachable during the outage they had caused.
- Resolution only returned when the operator deleted the fingerprint from the root, which tells resolvers the zone is simply unsigned. It has not been restored, so .al domains today have no DNSSEC protection at all.
- 1.1.1.1 attaches the new error code to every answer under an active bypass, even for names that never used DNSSEC. The bypass covers the whole zone, so the disclosure covers the whole zone too.
- Failures like this arrive on a delay: the error rate climbs gradually as cached records expire and resolvers are forced to revalidate, rather than spiking the moment the chain breaks.
“NTAs restore resolution, but silently.”
“As of publishing, .al remains unsigned.”
“Installing a Negative Trust Anchor is an aggressive measure.”
“EDE 33 closes a gap that RFC 7646 left open.”
Checking sign-in…
Loading comments…