A routine piece of internet plumbing has disrupted part of Germany's health-care network. According to a report by heise online, Secunet and RISE connectors have lost their connection to the Telematikinfrastruktur (TI) in the course of the DNSSEC key exchange.
To understand why a DNS change can silence a medical practice, you have to look one layer down. DNSSEC adds cryptographic signatures to DNS answers so that a device can tell a genuine response from a forged one. To validate anything, a resolver needs a trust anchor: the public key of the root zone's key-signing key (KSK). That key is retired and replaced periodically, and the current rollover of the root KSK was scheduled for October 2026.
The failure mode is well known and unpleasant. If a resolver still trusts only the old key — or holds a hardcoded trust anchor nobody updated — then every signed lookup fails validation, the resolver answers SERVFAIL, and anything the device reaches by name stops resolving. VPN gateways, update servers and application back-ends all disappear at once, even though every cable and certificate is fine. The RFC 5011 mechanism exists precisely to let resolvers pick up a new root key automatically, but it only helps on devices that implement it and were online long enough before the change.
That is the trap the German connectors appear to have walked into. The TI is the network that links medical practices, hospitals, pharmacies, laboratories and other health-care actors; practices reach it through certified hardware connectors. When a connector cannot resolve its TI endpoints, the services riding on top — electronic prescriptions, electronic sick notes (eAU), and the electronic patient record — become unreachable from the affected site, turning an internet-infrastructure detail into a waiting room full of appointments that cannot be documented electronically.
The immediate remedy is technical and, in principle, straightforward: ship the new trust anchor in a firmware or software update, or route the device's name resolution through a resolver that has already updated. Vendors and operators of the affected connectors have been working on mitigations, and practices are advised to keep their devices on the latest software rather than deferring updates.
The larger point is architectural. DNSSEC is what makes the public DNS trustworthy, but building a closed, high-availability network on top of it imports the public root zone as a dependency — and that root changes keys on a schedule set elsewhere. Closed ecosystems such as the TI, which depend on name resolution to establish their own encrypted tunnels, inherit both the security and the fragility.
Details of the incident are still developing; the scope reported so far centres on Secunet and RISE connectors, and the description above is based on the initial report together with the technical background of the root KSK rollover.
