2026-05-09 · cloudflare
Cloudflare published a response to the .de DNSSEC outage after DENIC began serving incorrect signatures on May 5, 2026. The issue forced validating resolvers to reject the zone and made millions of domains unreachable. This was not a theoretical failure. It was a hierarchy-level outage in a core Internet control plane.
Cloudflare explains that the invalid DNSSEC signatures broke the chain of trust for the .de zone. Its public resolver applied temporary mitigations while the registry resolved the issue.
When DNS validation fails at the TLD level, entire groups of domains can disappear from reach. The operational cost is downtime, traffic loss, and emergency remediation across systems that depend on name resolution.
Cold storage helps by keeping authoritative DNS keys, recovery credentials, and rollback artifacts offline and protected. That makes it easier to restore trust material cleanly and avoid compounding an outage with compromised change paths.
Read Original Post →