Website QA intelligence for teams who ship
⚲
Guides Tool Comparisons QA Glossary Archive RSS Feed
heads-up platform & cms 1 sources 1 min read

Cloudflare Disables DNSSEC for .de Domains After DENIC Signing Issue

What happened

Cloudflare experienced widespread DNS resolution issues affecting German .de domains on May 5. The problem was traced to a DNSSEC signing failure at DENIC, the registry operator for Germany's .de top-level domain. To restore access, Cloudflare temporarily disabled DNSSEC validation for all .de domains on their 1.1.1.1 public DNS resolver, following RFC 7646 procedures. The incident affected any websites or services using .de domains that relied on Cloudflare's DNS infrastructure.

Business impact

Enterprise teams with .de domains experienced complete DNS resolution failures, potentially blocking customer access and causing revenue loss during the outage window. Organizations using Cloudflare's DNS services faced additional complexity in troubleshooting what appeared to be domain-specific connectivity issues rather than obvious infrastructure problems.

Background

DNSSEC provides cryptographic authentication for DNS responses, preventing cache poisoning and other DNS attacks. DENIC operates one of Europe's largest country-code domains with over 17 million registered .de domains. When DNSSEC signing fails at the registry level, resolvers that strictly validate signatures will reject all queries for affected domains, creating widespread connectivity issues.

What this means for your team

Audit your DNS dependency chain to identify which resolvers your CDN, monitoring tools, and infrastructure use. Test your incident response procedures for DNS-level failures that may not trigger standard uptime monitoring. Consider configuring backup DNS resolvers that use different validation policies. Document your domain portfolio by TLD to quickly assess impact scope during registry-level incidents.

What to watch

Monitor whether DENIC provides a post-incident analysis explaining the DNSSEC signing failure. Watch for similar incidents affecting other major ccTLD operators, as DNSSEC operational issues can cascade across registry infrastructure.

Sources

Related stories