DNSSEC Failures: 1.1.1.1 Unveils Transparency

Bridging the DNSSEC Transparency Gap

The incident involving the .AL TLD highlights a critical vulnerability in DNSSEC: the lack of visibility when validation is bypassed due to measures like Negative Trust Anchors (NTAs). While NTAs are essential for restoring service during such failures, their silent operation previously left users and monitoring tools in the dark, unable to distinguish legitimate, albeit unvalidated, responses from potentially spoofed ones. Cloudflare's proactive implementation of Extended DNS Error (EDE) code 33 is a significant step forward, providing much-needed transparency. This innovation directly addresses the core problem of hidden validation bypass, empowering users and operators with the knowledge that a response, while functional, has not undergone full DNSSEC verification. The rapid rollout to 1.1.1.1 and the push for broader adoption through IETF discussions are commendable, as this mechanism has the potential to significantly improve the reliability and trustworthiness of the DNS ecosystem during disruptive events.

However, the reliance on NTAs itself, even with enhanced transparency, remains a workaround rather than a permanent solution. The underlying issue is the broken DNSSEC configuration at the TLD level. While EDE 33 provides crucial context, it doesn't resolve the initial problem of compromised DNSSEC integrity for the affected zone. The article correctly points out that .AL remains unsigned as of publication, meaning its domains are inherently less secure. Furthermore, the effectiveness of EDE 33 relies on resolver implementations adopting it. The article mentions efforts with kdig and Unbound, but widespread adoption across all major resolvers will be a gradual process. Until then, users relying on non-EDE-aware resolvers might still experience the original lack of transparency, even if 1.1.1.1 is providing it. The incident also underscores the importance of robust communication channels between TLD operators and DNS service providers, as communication failures can exacerbate outages.

Key Points

• A broken DNSSEC rollover for the .AL TLD caused a widespread outage for Albanian domains on July 3, 2026.
• Cloudflare's 1.1.1.1 public DNS resolver temporarily suspended DNSSEC validation for .AL using a Negative Trust Anchor (NTA) to restore connectivity.
• Previously, NTAs masked validation bypass, leaving users unaware if responses were truly verified.
• For the first time, 1.1.1.1 is using a new Extended DNS Error (EDE) code (33) to signal when an NTA is active, providing transparency about bypassed validation.
• This EDE code, part of an Internet-Draft, aims to close the visibility gap left by RFC 7646.
• The .AL TLD remains unsigned as of the article's publication, lacking DNSSEC protections.

---

📖 Source: A broken DNSSEC rollover took down .AL. Now 1.1.1.1 tells you when validation is bypassed