Germany's .de domain outage traced to DNSSEC key rollover errors: what resolvers did

On May 6, 2026, Cloudflare published an incident report about a serious outage affecting Germany's .de top-level domain (TLD). The problem was not a network attack or hardware failure but a misstep during a routine DNSSEC key rollover at DENIC, the registry that operates .de. DNSSEC is a security layer that digitally signs DNS records, allowing resolvers to verify that the answer to a domain name query has not been tampered with. When the new keys were rolled out, the signatures that were generated and distributed could not be validated. This meant that any resolver that strictly enforced DNSSEC validation rejected the .de records, effectively taking many German websites offline for users around the world.

The incident exposed a subtle but important flaw in how Cloudflare's public resolver, 1.1.1.1, reported the failure. Instead of telling users that DNSSEC validation had failed, 1.1.1.1 returned an Extended DNS Error (EDE) code 22, which means "No Reachable Authority". That code usually points to a network connectivity problem with upstream servers, not a DNSSEC issue. Cloudflare traced this to a bug in how it propagates DNSSEC EDE codes from its trust chain verifier to the final response. When the verifier detects a bogus signature, it creates a DNSSEC Bogus EDE code, but that code never gets inserted into the answer sent to users. So the resolver falls back to reporting "No Reachable Authority," hiding the real cause. Cloudflare acknowledged this is not helpful for 1.1.1.1 users and said it will fix the responses to surface DNSSEC errors properly.

Faced with the outage, resolver operators across the internet quickly coordinated a workaround. Within about an hour, many applied what are called Negative Trust Anchors. A Negative Trust Anchor is a temporary configuration that instructs a resolver to skip DNSSEC validation for a specific domain, in this case .de, until the underlying fault is fixed. This allowed users to reach .de websites again even though the DNSSEC signatures were invalid. The DNS community's ability to react quickly relied on shared communication channels such as DNS-OARC, a forum where operators exchange information during incidents. Cloudflare highlighted that DNS is a decentralized system and that keeping it running depends on mutual trust and open lines of communication between registries, resolver operators, and the broader community.

DENIC, the .de registry, published its own short post about the incident. DENIC stated: "The outage is linked to a routine, scheduled key rollover. During this process, non-validatable signatures were generated and distributed. As a precautionary measure, future rollovers have been suspended until the exact technical causes have been identified." Cloudflare said it looks forward to DENIC's full post-incident report and appreciated the transparency shown. The outage also raised a philosophical question: does this mean DNSSEC itself is a failure? Cloudflare's answer is no. Any technology that is misconfigured can break for users who rely on it. The blog compares it to underwater fiber cables: leaving them exposed for sharks to chew on does not invalidate their importance, it only shows we sometimes fail to protect them. DNSSEC serves a critical role in ensuring DNS answers can be trusted without tampering.

The incident highlights a structural reality of the DNS hierarchy. When a registry at the TLD level fails, every domain under that TLD is affected simultaneously, regardless of where it is hosted or which resolver is used. This is not unique to DNSSEC; the same would happen if a TLD's nameservers became unreachable. There is no simple fix for this dependency. What the industry can do is respond quickly and consistently. In this case, resolver operators independently applied Negative Trust Anchors within an hour, restoring resolution while DENIC worked to fix the zone. Operational practices, industry communication channels like DNS-OARC, and features like serve stale (returning a slightly outdated but cached answer when live lookup fails) all reduce the impact, even if they cannot eliminate the underlying dependency. Cloudflare also came away with internal improvements: it will work on its EDE errors to better surface DNSSEC errors. For users who want to learn more about how DNSSEC works, Cloudflare points to How does DNSSEC work? and to real-time DNS trends on Cloudflare Radar.

For everyday internet users and website owners, this incident is a reminder that the domain name system, while usually invisible, can fail in ways that affect large parts of the web. Choosing a resolver that is transparent about errors and actively maintains DNSSEC validation matters. Using a privacy-first encrypted DNS service like AEU DNS helps protect your queries from being spied on or altered, and it adds a layer of reliability because such providers typically monitor DNSSEC faults and apply mitigations quickly. If you operate a website under a country-code TLD, follow your registry's technical notices and test any DNSSEC key changes before rolling them out. The .de outage shows that even routine maintenance can have global consequences, and honest reporting of errors is essential for quick recovery.