Network & Infrastructure / DNS, DNSSEC & Service Discovery
Resolver clock skew and widespread DNSSEC validation failures
Several unrelated signed domains suddenly fail through one resolver. A bad local clock can invalidate otherwise correct signatures across many zones simultaneously.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Compare resolver time with trusted time sources, signature validity intervals and failures from an independent resolver. Check recent VM suspend, restore or time-service events.
Explain the result
DNSSEC signature validation depends on time as well as keys and record integrity. Broad validation failure can originate locally even when every authoritative zone remains correctly signed.
Plan the fix
Repair the time dependency and monitor synchronization state. Avoid disabling DNSSEC globally or repeatedly changing trusted keys before checking whether the validity window is being evaluated against the correct time.
Check the result and rollback
Validate several independent signed zones after time recovery and monitor recurrence through restart. Revert a new time-source configuration if it is unstable or violates the organization's authenticated-time policy.