The Day Germany Disappeared: How a Single Cryptographic Error Paralyzed the .de Namespace

A malformed DNSSEC signature published by DENIC during a Zone Signing Key rotation caused widespread resolution failures for the .de namespace as validating recursive resolvers returned SERVFAIL, making millions of German domains (including major sites) inaccessible; Cloudflare temporarily disabled DNSSEC validation for the .de zone to reduce user impact while DENIC works to restore correct signatures and propagation completes. The outage is attributed to a configuration/operational error rather than confirmed malicious activity, though commentators warned the emergency disabling of DNSSEC validation could present a vector for future abuse.