A broken DNSSEC rollover took down .AL. Now 1.1.1.1 tells you when validation is bypassed

This post details the incident where the .al TLD experienced a DNSSEC key rollover failure, leading to validation errors and service unavailability. Cloudflare's 1.1.1.1 resolver applied a Negative Trust Anchor (NTA) to restore resolution, a measure previously used for the .de TLD. For the first time, 1.1.1.1 implemented and signaled the use of an NTA via Extended DNS Error (EDE) code 33, as defined in a new Internet-Draft. This EDE code, along with EDE 9 (DNSKEY Missing), provided clients with explicit information that DNSSEC validation was bypassed due to the NTA, closing a transparency gap in RFC 7646. The post also discusses the technical breakdown of the .al DNSSEC failure, including the DS record mismatch and the subsequent removal of the DNSKEY and DS records.