# .AL TLD Goes Down, 1.1.1.1 Signals DNSSEC Bypass

Albania's internet domains became inaccessible due to a DNSSEC failure.

- **Source:** [Cloudflare Blog](https://blog.cloudflare.com)
- **Published:** 2026-07-14
- **Original article:** <https://blog.cloudflare.com/dnssec-nta-ede-33/>
- **On Brifing:** https://brifing.si/s/befc03d7-dba8-43e4-878e-38d97cf88eaa

## DNSSEC Failure and .AL TLD

On July 3, 2026, the Albanian Communications Authority (AKEP) attempted a DNSSEC key rollover for the .AL country-code top-level domain (TLD). However, an error occurred, causing DNSSEC validation to fail and rendering .AL domains inaccessible.

## Cloudflare's Intervention

Cloudflare's 1.1.1.1 DNS resolver rejected .AL domains due to the DNSSEC validation failure. Cloudflare applied a Negative Trust Anchor (NTA) to temporarily suspend DNSSEC validation and keep the domains reachable.

## What is a Negative Trust Anchor?

A Negative Trust Anchor (NTA) is a mechanism that temporarily disables DNSSEC validation. This ensures domains remain accessible but weakens the security of DNS responses.

## Mistakes by the .AL Operator

The .AL operator published a new DNSKEY but failed to update the DS record in the root zone. This caused DNSSEC validation to fail and made .AL domains inaccessible.

## Extended DNS Error Code

Cloudflare used the Extended DNS Error (EDE) code for the first time during the .AL incident. This code indicates that DNSSEC validation was bypassed due to an NTA, providing transparency to users.

## Importance of the DNSSEC Chain

DNSSEC builds a chain of trust from the root zone down to domain names. Any break in this chain causes domains to fail validation and become inaccessible.

## Similar Incident: .DE TLD

Just two months before the .AL incident, Germany's .DE TLD experienced a similar DNSSEC failure. Cloudflare also applied an NTA in that case to keep domains reachable.

## Risks of NTAs

Applying an NTA suspends DNSSEC validation and weakens the security of DNS responses. This increases the risk of users being exposed to spoofed responses.

## Internet Infrastructure and Security

This incident highlights the fragility of internet infrastructure and the importance of correctly implementing security mechanisms like DNSSEC. Innovations like Cloudflare's EDE code provide transparency for users.

## Sources covering this story

- https://blog.cloudflare.com/dnssec-nta-ede-33/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._