German Internet Goes Offline In Massive DNS Outage
Millions of German websites and digital services went offline last night after Germany’s .de top-level domain became unreachable, causing apps and sites such as Amazon.de and the Deutsche Bahn public transportation app to fail. The outage lasted roughly three hours as DNS resolvers worldwide returned SERVFAIL errors for .de domains. Importantly, the affected websites and DNS records themselves were not necessarily broken — the failure originated at the registry layer, with DENIC eG, the operator of Germany’s .de domain, confirming a disruption in its DNS service.
The suspected issue appears tied to DNSSEC validation, with engineers pointing to malformed cryptographic signatures or a possible failed Zone Signing Key rollover. DNSSEC is designed to protect DNS integrity through cryptographic signing, but when those signatures break, validating resolvers may reject responses entirely — effectively making an entire domain zone disappear from the internet. With approximately 17.7 million .de domains affected, the incident exposed a massive single point of failure in national digital infrastructure: one registry-level DNSSEC problem was enough to disrupt commerce, transport, apps, and public-facing services across Germany. Cloudflare temporarily disabled DNSSEC validation for .de domains as a workaround while DENIC restored service.
Incidents like this demand a unified infrastructure observability and NetOps platform, such as NIKSUN, that consolidates DNS monitoring, DNSSEC validation telemetry, NPM, APM, availability monitoring, BGP/routing visibility, packet data, flows, logs, synthetic tests, and service dependency mapping into one real-time data lake. When DNS failures, application outages, and network symptoms are analyzed together, teams can instantly distinguish between a broken website, resolver issue, registry failure, DNSSEC signature error, or routing problem. With AI root-cause analysis, agentic orchestration, automated diagnostics, and 100% infrastructure visibility, organizations can trace failures from user experience to DNS authority to network path — turning a nationwide mystery outage into a rapidly understood, actionable incident. Read more about this story on our LinkedIn page
The suspected issue appears tied to DNSSEC validation, with engineers pointing to malformed cryptographic signatures or a possible failed Zone Signing Key rollover. DNSSEC is designed to protect DNS integrity through cryptographic signing, but when those signatures break, validating resolvers may reject responses entirely — effectively making an entire domain zone disappear from the internet. With approximately 17.7 million .de domains affected, the incident exposed a massive single point of failure in national digital infrastructure: one registry-level DNSSEC problem was enough to disrupt commerce, transport, apps, and public-facing services across Germany. Cloudflare temporarily disabled DNSSEC validation for .de domains as a workaround while DENIC restored service.
Incidents like this demand a unified infrastructure observability and NetOps platform, such as NIKSUN, that consolidates DNS monitoring, DNSSEC validation telemetry, NPM, APM, availability monitoring, BGP/routing visibility, packet data, flows, logs, synthetic tests, and service dependency mapping into one real-time data lake. When DNS failures, application outages, and network symptoms are analyzed together, teams can instantly distinguish between a broken website, resolver issue, registry failure, DNSSEC signature error, or routing problem. With AI root-cause analysis, agentic orchestration, automated diagnostics, and 100% infrastructure visibility, organizations can trace failures from user experience to DNS authority to network path — turning a nationwide mystery outage into a rapidly understood, actionable incident. Read more about this story on our LinkedIn page