.AL TLD Goes Down, 1.1.1.1 Signals DNSSEC Bypass
Albania's internet domains became inaccessible due to a DNSSEC failure.
1DNSSEC Failure and .AL TLD
On July 3, 2026, the Albanian Communications Authority (AKEP) attempted a DNSSEC key rollover for the .AL country-code top-level domain (TLD). However, an error occurred, causing DNSSEC validation to fail and rendering .AL domains inaccessible.
2Cloudflare's Intervention
Cloudflare's 1.1.1.1 DNS resolver rejected .AL domains due to the DNSSEC validation failure. Cloudflare applied a Negative Trust Anchor (NTA) to temporarily suspend DNSSEC validation and keep the domains reachable.
3What is a Negative Trust Anchor?
A Negative Trust Anchor (NTA) is a mechanism that temporarily disables DNSSEC validation. This ensures domains remain accessible but weakens the security of DNS responses.
4Mistakes by the .AL Operator
The .AL operator published a new DNSKEY but failed to update the DS record in the root zone. This caused DNSSEC validation to fail and made .AL domains inaccessible.
5Extended DNS Error Code
Cloudflare used the Extended DNS Error (EDE) code for the first time during the .AL incident. This code indicates that DNSSEC validation was bypassed due to an NTA, providing transparency to users.
6Importance of the DNSSEC Chain
DNSSEC builds a chain of trust from the root zone down to domain names. Any break in this chain causes domains to fail validation and become inaccessible.
7Similar Incident: .DE TLD
Just two months before the .AL incident, Germany's .DE TLD experienced a similar DNSSEC failure. Cloudflare also applied an NTA in that case to keep domains reachable.
8Risks of NTAs
Applying an NTA suspends DNSSEC validation and weakens the security of DNS responses. This increases the risk of users being exposed to spoofed responses.
9Internet Infrastructure and Security
This incident highlights the fragility of internet infrastructure and the importance of correctly implementing security mechanisms like DNSSEC. Innovations like Cloudflare's EDE code provide transparency for users.
Original article: Cloudflare Blog — .AL TLD Çöktü, 1.1.1.1 DNSSEC Geçersizliğini Bildiriyor