{"id":"INC-cloudflare-8odt36zmvm36","kind":"incident","aliases":[],"related":[],"title":"Cloudflare: DNSSEC Configuration Change Issues","description":"Cloudflare is investigating issues with enabling or disabling DNSSEC (Domain Name System Security Extensions) signing.\n\nWe are working to understand the full impact and mitigate this\nproblem. More updates to follow shortly.","summary":"Cloudflare reports it is investigating problems when customers enable or disable DNSSEC signing on their domains. The sources give no attacker capability; the risk is a DNS configuration that does not change as intended.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Cloudflare","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cdn","cloudflare","dns","dnssec","incident","ops","security","vendor"],"not_affected_if":["no-dnssec-changes-in-window"],"how_to_check":"- Check the DNSSEC status of your domain in the Cloudflare dashboard under DNS settings.\n- Compare the live DS record at your registrar with what Cloudflare shows for the zone.\n- Watch the Cloudflare status page for the incident's resolution notice.","fix":null,"status":"resolved","published_at":"2026-11-12T04:53:29+00:00","first_seen_at":"2026-11-12T04:54:33+00:00","triaged_at":"2026-11-12T04:55:38+00:00","updated_at":"2026-11-12T05:28:30+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-12T04:55:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Cloudflare: DNSSEC enable and disable changes are failing","impact":"low","summary":"Cloudflare reports it is investigating problems when customers enable or disable DNSSEC signing on their domains. The sources give no attacker capability; the risk is a DNS configuration that does not change as intended.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["cloudflare","dns","dnssec"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"DNSSEC signing state on a domain does not match what the operator set","analyst_note":"Monitor the Cloudflare status page for scope and resolution details.","how_to_check":"- Check the DNSSEC status of your domain in the Cloudflare dashboard under DNS settings.\n- Compare the live DS record at your registrar with what Cloudflare shows for the zone.\n- Watch the Cloudflare status page for the incident's resolution notice.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-dnssec-changes-in-window"],"who_is_affected":"Customers who enable or disable DNSSEC signing on Cloudflare-hosted domains while this incident is open may see the change not apply correctly. The sources do not say which accounts or zones are affected, and do not describe any attacker access.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000714,"input_tokens":4540,"output_tokens":520,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'8odt36zmvm36':9A 'attack':39B 'capabl':40B 'cdn':11B 'chang':4A,50B 'cloudflar':1A,12B,19B,53C 'cloudflare':8A,10A 'configur':3A,46B 'custom':26B 'disabl':29B,60C 'dns':13B,45B 'dnssec':2A,14B,30B,61C 'domain':34B,62C 'enabl':27B,58C 'extens':66C 'follow':83C 'full':74C 'give':37B 'impact':75C 'inc':7A 'inc-cloudflare-8odt36zmvm36':6A 'incid':15B 'intend':52B 'investig':23B,55C 'issu':5A,56C 'mitig':77C 'name':63C 'op':16B 'problem':24B,79C 'report':20B 'risk':42B 'secur':17B,65C 'short':84C 'sign':31B,67C 'sourc':36B 'system':64C 'understand':72C 'updat':81C 'vendor':18B 'work':70C","nicknames":[],"mitigations":[],"who_affected":"Customers who enable or disable DNSSEC signing on Cloudflare-hosted domains while this incident is open may see the change not apply correctly. The sources do not say which accounts or zones are affected, and do not describe any attacker access.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["cloudflare"],"ptokens":["cloudflare"],"labels":["cdn","cloudflare","dns","dnssec","incident","medium","ops","security","vendor"],"campaign_type":null,"search_a":"'8odt36zmvm36':9A 'chang':4A 'cloudflar':1A 'cloudflare':8A,10A 'configur':3A 'dnssec':2A 'inc':7A 'inc-cloudflare-8odt36zmvm36':6A 'issu':5A","search_b":"'attack':39B 'capabl':40B 'cdn':11B 'chang':50B 'cloudflar':12B,19B 'configur':46B 'custom':26B 'disabl':29B 'dns':13B,45B 'dnssec':14B,30B 'domain':34B 'enabl':27B 'give':37B 'incid':15B 'intend':52B 'investig':23B 'op':16B 'problem':24B 'report':20B 'risk':42B 'secur':17B 'sign':31B 'sourc':36B 'vendor':18B","search_c":"'cloudflar':53C 'disabl':60C 'dnssec':61C 'domain':62C 'enabl':58C 'extens':66C 'follow':83C 'full':74C 'impact':75C 'investig':55C 'issu':56C 'mitig':77C 'name':63C 'problem':79C 'secur':65C 'short':84C 'sign':67C 'system':64C 'understand':72C 'updat':81C 'work':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:53:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"cloudflare:8odt36zmvm36","url":"https://www.cloudflarestatus.com/incidents/8odt36zmvm36","severity":"medium","published_at":"2026-11-12T04:53:29+00:00","modified_at":"2026-11-12T05:26:45+00:00","first_seen_at":"2026-11-12T04:54:33+00:00","fetched_at":"2026-11-12T05:41:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}