What happened during the .de DNS outage?

A large number of .de domains became unreachable worldwide. This wasn’t a hack. It was DNS.

What happened?

Around 21:57 (CET), the issue started.

DENIC, the registry for .de domains, published invalid DNSSEC signatures for the .de zone.

This likely happened during a key rollover or maintenance.

.de zone → invalid DNSSEC signatures → SERVFAIL

Resolvers that validate DNSSEC rejected the responses.

Many DNS resolvers returned SERVFAIL.

Result:

This mainly affected domains with DNSSEC enabled, which includes most large .de websites.

DNSSEC adds cryptographic validation to DNS.

If a signature is invalid, resolvers will block the response for security reasons.

This means:

DENIC deployed a corrected zone around 00:08.

By 01:15, the issue was resolved.

Total downtime: a few hours.

This was not an attack.

It was a DNSSEC misconfiguration at the registry level.

DENIC is still investigating the root cause and has paused future key rollovers.

Even at the highest level, DNS can fail.

A single mistake in DNSSEC can make entire domains unreachable worldwide.

This incident shows how critical correct DNS configuration really is.