When Germany's TLD broke: the .DE DNSSEC outage and what "serve stale" saved
Published May 7, 2026 · DNS Benchmark Pro Editorial · Reading time: 2 minutes
In short — On 5 May 2026, DENIC published broken DNSSEC signatures for .DE, putting millions of German domains at risk of vanishing. Cached records and a Negative Trust Anchor absorbed most of the damage.
On 5 May 2026, DENIC — the registry that operates Germany's .DE top-level domain — published broken DNSSEC signatures. Millions of domains underneath .DE became unresolvable for any resolver that validates DNSSEC, which is to say most of the ones people actually use.
The mechanics are the same failure mode that would later take out .AL in July. DNSSEC builds a chain of trust from the root zone downwards: the root holds a Delegation Signer record for each signed TLD, which is a fingerprint of that TLD's DNSKEY. A resolver validating a .DE name checks that the DNSKEY served by DENIC's nameservers matches the DS record in the root. When those two stop agreeing — because a key was rotated out of sequence, or a signature was generated incorrectly — validation fails for everything below that point. Not one domain. All of them.
Why it was not worse
Two mechanisms did the heavy lifting.
Serve stale. Defined in RFC 8767, serve-stale lets a resolver keep handing out expired cached records when it cannot get a fresh authoritative answer. In a TLD-level DNSSEC break, that turns a cliff into a slope: rather than everything failing the instant signatures go bad, failures appear gradually as individual cached records age out. Cloudflare reported that this materially cushioned the impact, buying time before the SERVFAIL rate climbed.
Negative Trust Anchors. Cloudflare then installed an NTA for .DE, instructing 1.1.1.1 to treat the zone as unsigned and skip validation until DENIC fixed the underlying problem. Domains came back. The cost, as always, is that .DE spent that window with no DNSSEC protection at all.
One detail that only became visible in hindsight: during the .DE incident 1.1.1.1 returned EDE 22 (No Reachable Authority) rather than surfacing the real DNSSEC error, and clients had no signal at all that an NTA was in place. Both of those gaps were fixed by July, when the .AL outage saw 1.1.1.1 return the correct EDE 9 plus the newly assigned EDE 33 (Negative Trust Anchor).
The takeaway
DNSSEC is a genuine security improvement and it is also a genuine availability risk, and pretending otherwise helps nobody. It converts a class of silent attack into a class of loud outage. That is usually the right trade — but it concentrates a great deal of operational risk in registry key management, where a single sequencing error takes an entire country's namespace offline.
For end users the practical lesson is unglamorous: the resolver you pick determines how well you ride out somebody else's mistake. Serve-stale support, fast NTA deployment and honest error signalling are not features anybody markets, and they are exactly what separates a three-hour blip from a full day of "the internet is broken".
Source: Cloudflare Blog, "When DNSSEC goes wrong: how we responded to the .de TLD outage" (6 May 2026).
Published by Genext Information Systems · May 7, 2026. DNS Benchmark Pro is an independent tool and is not affiliated with any vendor or organisation named in this article. This report summarises publicly available disclosures and is provided for informational purposes.