There is some chatter about a CA mis-issuing a certificate for 1.1.1.1. https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/SgwC1QsEpvc/m/0V_VMV7uAgAJ
This CA (https://crt.sh/?caid=201916, only ~300 certs) is only trusted by (1) the Microsoft root program, and (2) the eIDAS QWAC trusted list.
MS has not been actively managing their root program for years now, and the EU wanted to push theirs on browsers with much better ones.
I was getting SERVFAIL both from my local DNS server and from Google. So I am confident there was something wrong with the authoritative servers for the domain.
Now I am getting a different error though.
@kasperd that's really strange, the first screenshot says nx domain...
Anyhow, it's not that interesting after all.
It’s a known problem that there are browsers saying NXDOMAIN to the user for every DNS problem even if it’s not NXDOMAIN at all.
When I got that error at first I verified using the dig and host commands that it was a SERVFAIL error and that I also got that error from other DNS servers.
Filippo Valsorda
Pontiff Fractal Tiam
kasperd