Connection errors in Asia Pacific region on July 9, 2023
Jul 11, 2023Christian Elmerot, Alex Fattouche, Hannes Gerhart
Summary
This post details an incident where expired DNSSEC signatures from Verisign's .com and .net TLD nameservers in the Asia Pacific region caused DNS resolution failures for Cloudflare customers. The issue impacted customers using CNAME records for origin DNS resolution. Cloudflare mitigated the impact by rerouting DNS traffic to Verisign's US west coast nameservers. The post explains the technical details of DNSSEC validation, the incident timeline, and the root cause of expired signatures.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available