How Cloudflare's 1.1.1.1 Now Warns When DNSSEC Validation is Bypassed
Another Entry in the "Stuff Im Glad Im Not Responsible for" Ledger
When a broken DNSSEC rollover took down the .AL domain, Cloudflare deployed a Negative Trust Anchor to restore access. For the first time, our 1.1.1.1 resolver now signals this bypass directly to clients using a new Extended DNS Error code. This transparency ensures users know exactly when their DNS responses lack cryptographic validation, bridging a critical gap in DNS security visibility.
NTAs restore resolution, but silently. A client receiving a response served under an NTA has no way to tell, from the response alone, that DNSSEC validation was bypassed, leaving it unable to distinguish a legitimate answer from a spoofed one.