.de is returning NSEC3 opt-out denial for DS on multiple .de domains, but Let’s Encrypt validation intermittently marks it Bogus with “not all NSEC3 records secure.” Raw dig +dnssec from n.de.net returns NSEC3/RRSIG material, but validator acceptance is failing. The issue started to happen a couple…

Doesn't look like this is unique to Let's Encrypt validation. If DNSSEC is present LE validates it so would (rightly) fail for invalid DNSSEC. I am getting Bogus results for pepsi.de and amazon.de from this testing tool that we often use. amazon.de | DNSViz …

They're aware https://status.denic.de/ [image]

Since NSEC3 records also currently have invalid signatures, unsigned domains are also affected.

In fact it's the other way around: I'm only seeing valid RRSigs for domains with a DS record (as there is no NSEC involved here), so DNSSEC-signed domains resolve properly. It's the unsigned domains that don't work, as the NSEC record currently being served is invalid for some domains. However, it's…

Looks like they had a maintenance scheduled for today: [COMPLETED] DENIC (.DE) Registry Scheduled Maintenance - May 5, 2026 - Namecheap Status

Issues getting certificates for .de zone

Help

edo888 May 5, 2026, 9:43pm 3

Do you think we need to contact DENIC to let them know about the issue?

Topic		Replies	Views
"The server could not connect to the client to verify the domain :: DNS problem: SERVFAIL looking up A" Help	14	4767	December 22, 2017
DNS problem: SERVFAIL looking up CAA Help	16	4349	May 8, 2021
DNSKEY Missing: validation failure Help	36	2883	August 19, 2024
Subdomains or SAN additions and DNS validation Help	22	2669	June 25, 2022
Domain authentication fails with dns-rfc2136 plugin Help	15	1575	July 27, 2022

Issues getting certificates for .de zone

Related topics