The break was a mismatch, not an attack: .al published a new signing key and withdrew the old one while the root zone's fingerprint still pointed at the old key id, so every validating resolver found no matching key and failed.
Cloudflare could not reach the registry to report it, because the operator's contact addresses were themselves .al domains — unreachable during the outage they had caused.
Resolution only returned when the operator deleted the fingerprint from the root, which tells resolvers the zone is simply unsigned. It has not been restored, so .al domains today have no DNSSEC protection at all.
1.1.1.1 attaches the new error code to every answer under an active bypass, even for names that never used DNSSEC. The bypass covers the whole zone, so the disclosure covers the whole zone too.
Failures like this arrive on a delay: the error rate climbs gradually as cached records expire and resolvers are forced to revalidate, rather than spiking the moment the chain breaks.
Why it matters
Understanding EDE 33 helps engineers debugging DNS resolution issues distinguish 'validation bypassed due to a registry error' from silent failures or spoofing, and shows how resolver operators are patching systemic trust gaps at internet scale.
Key quotes
“NTAs restore resolution, but silently.”
“As of publishing, .al remains unsigned.”
“Installing a Negative Trust Anchor is an aggressive measure.”
