#dnssec

Analysis · May 11, 2026 · Colten Anderson

The .de outage was a TLD postmortem, not a patch you missed

DENIC's signing pipeline shipped two-thirds bad signatures during a routine ZSK rotation on May 5. Nothing in your environment caused it, and nothing in your environment could prevent it. Here's what you can still change at your resolver.