Security · 4h ago
Cloudflare's 1.1.1.1 Now Flags DNSSEC Bypass with New Error Code
A failed DNSSEC key rollover took down the .AL top-level domain. Cloudflare deployed a Negative Trust Anchor to restore resolution, but this time it returned EDE 33, a new DNS error code that signals DNSSEC validation was bypassed. The code lets clients know directly in the response that security was weakened.
Meridian48 take
The new EDE 33 code adds transparency to DNSSEC failures, but it's a band-aid for a systemic fragility in the DNS trust model.
Read the full reporting
A broken DNSSEC rollover took down .AL. Now 1.1.1.1 tells you when validation is bypassed →
Cloudflare Blog
dnsseccloudflare