What happened
Amazon MQ has added the ability to set EBS storage capacity for RabbitMQ brokers independently of the chosen instance type, beginning with M7g brokers running version 4.2 or later. Previously, storage was tied to instance selection, forcing teams to over-provision compute simply to reach a desired disk size. Separately, Cloudflare documented how a botched DNSSEC key rollover caused the entire .al top-level domain to go dark, prompting the company to deploy a Negative Trust Anchor to restore resolution. Crucially, Cloudflare's 1.1.1.1 resolver now returns Extended DNS Error code 33 in those situations, embedding a machine-readable signal directly in the DNS response to indicate that DNSSEC validation was intentionally bypassed.
Why it matters for your business
For teams running high-throughput messaging workloads on Amazon MQ, decoupled storage means cost structures can be optimized without touching compute capacity — a meaningful saving when message queues accumulate large backlogs or require extended retention. Operations teams can now scale storage at broker creation or update time without rearchitecting around instance constraints. On the DNS side, the introduction of EDE 33 gives security-conscious organizations a programmatic way to detect when a resolver has silently bypassed DNSSEC validation on their behalf. Rather than trusting that resolution simply worked, monitoring tooling can now interrogate DNS responses for this error code and trigger alerts or audit logs when validation is skipped — a practical improvement for zero-trust network postures and compliance workflows.
What to watch next
AWS is likely to extend configurable storage to additional Amazon MQ broker types and RabbitMQ versions as the feature matures, so teams on older configurations should monitor the roadmap. On the DNS front, broader adoption of EDE codes across other public resolvers and enterprise DNS products will determine how actionable this transparency signal becomes at scale. Registry operators managing TLD infrastructure should treat the .al incident as a cautionary case study and audit their own DNSSEC key rollover procedures before a similar failure surfaces.