Cloudflare's 1.1.1.1 Now Signals DNSSEC Bypass After .AL Meltdown

On July 3, 2026, the Albanian TLD operator AKEP fumbled a DNSSEC key rollover, breaking the chain of trust for every .AL domain. Validating resolvers like 1.1.1.1 had to reject all .AL responses, making government, banking, and media sites unreachable for hours. Cloudflare applied a Negative Trust Anchor (NTA) to restore resolution, but this time they added a new Extended DNS Error (EDE) code to make the bypass visible to clients.

What Went Wrong

DNSSEC chains trust from the root zone down. The root holds a DS record that fingerprints a TLD's DNSKEY. When .AL's operator published a new DNSKEY without updating the DS record, the root still pointed to the old key. Resolvers found no matching DNSKEY and failed validation. The operator then removed the new key entirely, leaving the zone with no DNSKEY at all, while the DS record still referenced the old key. Hours later, they removed the DS record from the root, leaving .AL unsigned.

The same pattern hit .DE two months earlier. Cloudflare's response then was to install an NTA (RFC 7646), which tells the resolver to treat the zone as unsigned. It works, but silently — clients get answers with no indication that DNSSEC protection was bypassed.

EDE 33: Negative Trust Anchor Transparency

Cloudflare now returns EDE code 33 alongside every response served under an NTA. The code signals that a Negative Trust Anchor was active, meaning the answer was not cryptographically verified. For the .AL incident, queries also returned EDE 9 (DNSKEY Missing) to explain the underlying failure.

Here's what a dig response looks like with both codes:

$ kdig @1.1.1.1 google.al
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 32848
;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: ; UDP size: 1232 B; ext-rcode: NOERROR
;; EDE: 9 (DNSKEY Missing): 'no SEP matching the DS found for al.'
;; EDE: 33 (Negative Trust Anchor): 'a Negative Trust Anchor has been applied for this query (see RFC 7646)'

;; ANSWER SECTION:
google.al.              300    IN    A    142.251.142.196

The EDE 33 code is returned for every query under an active NTA, even for domains that don't use DNSSEC. This is deliberate: the NTA covers the entire zone, and transparency should be uniform.

Why This Matters

NTAs are a blunt instrument. They restore availability at the cost of security. Previously, clients had no way to distinguish a validated response from one served under an NTA. Status pages require users to go looking. EDE 33 brings that information into the DNS response itself, enabling monitoring tools and applications to react appropriately.

Cloudflare co-authored the draft with Quad9's Babak Farrokhi. The implementation is live on 1.1.1.1 as of the .AL incident. It's a small but meaningful step toward making DNSSEC failure modes less opaque.