DNSSEC issues take Fiji domains offline
Mar 9, 2022David Belson

Summary
This post details an incident where DNSSEC misconfiguration at the .fj ccTLD level caused widespread domain outages. It explains how Cloudflare's 1.1.1.1 resolver data and traffic metrics indicated a DNS-related issue, not a general connectivity problem. The root cause was identified as a missing DNSKEY record for the .fj zone, indicated by EDE: 9. The post explains the relationship between DS and DNSKEY records and how the misconfiguration likely occurred during a scheduled rollover without updating the root zone. The resolution involved updating the DS record in the root zone.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available