Due to configuration mistake authentication of VPN tunnels failed.
Unfinished configuration had been in place a while, but HIIT-VPN service wasn't restarted until due to OpenSSL library vulnerability (see the break report). After restart the configuration mistake was taken into production and thus all authentication attempts failed.
Due to zone delegation configuration error some of HIIT's zones, more specifically
were not propagated to ns-secondary.funet.fi. Because HIIT has three (3) name servers (name.it.hiit.fi, label.it.hiit.fi and ns-secondary.funet.fi) one third (1/3) of queries to previously mentioned zones failed due to ns-secondary.funet.fi not knowing those previously mentioned zones.
The problem is being investigated.
Update at 2014-03-17 11:31: The configuration error in HIIT DNS external zone view delegation settings was found and fixed and all zones are OK now.