A broken DNSSEC rollover took down .al. Now 1.1.1.1 tells you when validation is bypassed
- ID
- 4650
- Status
- summarized
- Published
- 14 Jul 2026, 9:00 PM
- Fetched
- 16 Jul 2026, 3:33 AM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/dnssec-nta-ede-33/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 7.0
- Created
- 16 Jul 2026, 3:33 AM
- Tags
- Audience
- developersvibe_coders
What happened
A failed DNSSEC key rollover took down Albania's .al TLD, prompting Cloudflare to deploy a Negative Trust Anchor (NTA) on its 1.1.1.1 resolver to restore resolution. Notably, 1.1.1.1 now returns EDE 33, an Extended DNS Error code that tells clients directly in the DNS response that DNSSEC validation was bypassed for that query.
Why it matters
DNSSEC misconfigurations can take entire TLDs offline, and any builder running domains with DNSSEC enabled should understand the rollover failure mode and how resolvers communicate trust bypass. EDE 33 is a meaningful step toward transparency: instead of silently failing or silently bypassing, resolvers can now signal to clients that validation was skipped, which helps with debugging and accountability. For Malaysian startups and developers managing their own DNSSEC, this is a reminder to monitor key rollovers and test against multiple resolvers.
Discussion angle
Walk through what a Negative Trust Anchor is, why EDE 33 matters for transparency, and what practical checks a small team should do if they enable DNSSEC on their own domains to avoid a similar outage.