The night DNSSEC broke .de

Wed, 06 May 2026 09:00:00 +0200

Last night, large parts of the German internet quietly broke. Not for everyone — which made it more confusing, not less. Bahn.de, Spiegel.de, and thousands of other .de domains returned SERVFAIL to anyone using a security-conscious DNS resolver. The culprit was DENIC, the registry responsible for the .de top-level domain, and a botched key rollover in their DNSSEC setup.

What DNSSEC is supposed to do

DNS — the system that translates domain names like spiegel.de into IP addresses — was designed in an era when the internet was a considerably more trusting place. It has no built-in mechanism to verify that the answers you receive are genuine and haven’t been tampered with in transit. An attacker positioned between you and your DNS resolver can, in principle, return fake records and silently redirect you to a malicious server.

Internet on Christian Spoo

The night DNSSEC broke .de

What DNSSEC is supposed to do