cv-industrial.com is signed and its signatures have expired. Validating resolvers return SERVFAIL, which means the domain does not exist for a large share of the internet — and the DNS provider is not the one you have a relationship with.
Confirm it, precisely
dig cv-industrial.com SOA @1.1.1.1
-> status: SERVFAIL, no ad flag
dig cv-industrial.com SOA @1.1.1.1 +cd
-> NOERROR, answer present
(+cd disables checking: the data is there, the
signatures are the problem)
dig +dnssec cv-industrial.com SOA @<its own nameserver>
-> read the RRSIG expiration field
That third command dates the outage.The +cd comparison is the one that settles it in a sentence: the records are present and correct, and they cannot be validated. That is a signing problem rather than a DNS problem, and it tells whoever owns that provider relationship exactly what to say.
Three options, ranked
| Option | Effect | Cost |
|---|---|---|
| Get the provider to re-sign | Correct fix. The domain resolves again and stays signed. | Depends entirely on their responsiveness. Hours to days. |
Remove the DS at the parent | The domain becomes unsigned and resolves immediately for everyone. Protection lost, outage over. | A registrar change, and a TTL. Reversible. |
| Wait | Nothing. The outage continues and grows as caches turn over. | The worst option and the most common. |
Which, and when
- Try the provider first, with a deadline. Give it hours rather than days, and say what you will do if it is not fixed.
- Removing the DS is a legitimate emergency measure. An unsigned domain that resolves is better than a signed one that does not, and it is reversible once the signing is repaired.
- Do not re-add the DS until the signer is fixed and monitored. The same failure will recur — it recurred once already, silently.
- The finding is not the expiry. It is that a production domain stopped resolving and nobody detected it. That belongs in the report above the expiry itself.
Nobody noticed because the people who would complain do not validate
A resolver that does not validate serves the domain happily, so internal users and most consumer ISPs see nothing wrong. The users who cannot reach it are disproportionately at organisations that take security seriously — which is to say, business customers.