The attack on DigiNotar could have been a result of local DNS servers being flooded with fake DNS messages from attackers or a high-level DNS server being compromised and propagating the fake records down the hierarchy.