--- Begin Message ---
Hello,
We are seeing widespread DNSSEC validation failures for .al domains from major
validating resolvers.
IANA shows the .al root DS as:
26319 13 2 a6974512ccbff7610b03ef7b68150dcafc7f8df4640d619e0020d7532a175d03
Observed on 2026-07-03 around 14:41 UTC:
dig @1.1.1.1 superlumin.al A
=> SERVFAIL
=> EDE: DNSKEY Missing / no SEP matching the DS found for al
=> EDE: failed to verify signatures for superlumin.al opt-out proof / RRSIG NSEC
dig @8.8.8.8 superlumin.al A
=> SERVFAIL
dig @9.9.9.9 superlumin.al A
=> SERVFAIL / DNSSEC Bogus
With DNSSEC checking disabled, the same name resolves:
dig @1.1.1.1 +cdflag superlumin.al A
=> NOERROR, A records returned
This appears to affect multiple .al domains, including akep.al itself from some
resolver locations. Recovery appears uneven by resolver/network.
Could you please escalate this to .al registry DNS operations and verify the
.al DNSSEC DS/DNSKEY/RRSIG/NSEC signing state?
Affected domain example:
superlumin.al
Best Regards,
Jonas | Founder
The Superluminal Computing Corporation
--- End Message ---
_______________________________________________
dns-operations mailing list
[email protected]
https://lists.dns-oarc.net/mailman/listinfo/dns-operations
