When DNSSEC goes wrong: how we responded to the .de TLD outage

This post details Cloudflare's response to a DNSSEC signing outage for the .de TLD. It explains how the incident impacted 1.1.1.1 and the CDN platform, highlighting the role of 'serve stale' (RFC 8767) in mitigating user impact. The post describes the deployment of a Negative Trust Anchor (NTA) equivalent override rule for .de on 1.1.1.1 to bypass DNSSEC validation and restore service. It also details applying a similar mitigation to the internal origin resolution resolver and identifies a bug in the propagation of DNSSEC EDE codes, specifically EDE 6 (DNSSEC Bogus), which was incorrectly reported as EDE 22 (No Reachable Authority).