But this statement specially caught my attention:

Some operators of large resolvers had temporarily deactivated the validation of .de domains, thereby mitigating the impact on their users. We would like to thank them for their help.

It’s about #DNSSEC “negative trust anchors” or #NTA as defined in RFC7646. It states:

Technical personnel trained in the operation of DNS servers must confirm that a DNSSEC validation failure is due to misconfiguration, as a similar breakage could have occurred if an attacker gained access to a domain’s authoritative servers and modified those records or had the domain pointed to their own rogue authoritative servers. They should also confirm that the domain is not intentionally broken, such as for testing purposes as noted in Section 6. Finally, they should make a reasonable attempt to contact the domain owner of the misconfigured zone, preferably prior to implementing the NTA.

(Emphasis by me).

The aforementioned statement from DENIC as well as those by @cloudflare and @quad9dns indicate that no correspondence happened between DENIC and resolver operators before NTA was applied.

I didn’t like NTA from the very beginning, and now even more.

#DENIC published a blog on what went wrong on May 5th with the #DNSSEC on .de namespace:

https://blog.denic.de/en/analysis-of-the-dns-outage-on-5-may-2026/

It was a faculty piece of software. The described impact matches to what I could observe using DNSViz data.

#DNS