Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IO name servers down

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 29 posts

Re: IO name servers down

#13

Post by mrideout »

nodesocket wrote: post #3

Same here for my startup commando.io. Using AWS Route53. What DNS provider are you using?

I run a DNS monitoring service and have had a number of customers contact me about this in the past couple hours. Most of them were using Route53, but this is an issue with the IO authoritative nameservers, rather than Route53 itself.

Re: IO name servers down

#15

Post by jon-wood »

nodesocket wrote: post #6
turdnagel wrote: post #4

Earlier quoted context omitted.

Same here, also using Route 53.

I was certain I was getting DDoS'd, but then I inspected the Pingdom down notifications and seeing: DNS error

This is almost completely irrelevant, but what are you doing where you jump to DDoS before misconfiguration or a service outage?

Re: IO name servers down

#16

Post by [deleted] »

devnull42 wrote: post #10

It appears that the issue at first impacted all servers in the anycast pool however eventually it only impacted servers ns-a2 and ns-a4. Those servers started returning NXDOMAINs. I am wondering if this was related to the root server key change yesterday. .IO seems to struggle with basic DNS engineering. We are seeing stabilization except for minor issues still on one of the gTLD servers.

[deleted]

Re: IO name servers down

#18

Post by steventhedev »

devnull42 wrote: post #10

It appears that the issue at first impacted all servers in the anycast pool however eventually it only impacted servers ns-a2 and ns-a4. Those servers started returning NXDOMAINs. I am wondering if this was related to the root server key change yesterday. .IO seems to struggle with basic DNS engineering. We are seeing stabilization except for minor issues still on one of the gTLD servers.

The root server key won't actually change until next month. The DNSKEY responses from the root server was increased yesterday. Speculation, but it could be they're running ancient versions of BIND that fail with the larger response size. As per ICANN[0], the timeline is:

October 27, 2016: KSK rollover process begins as the new KSK is generated.

July 11, 2017: Publication of new KSK in DNS.

September 19, 2017: Size increase for DNSKEY response from root name servers.

October 11, 2017: New KSK begins to sign the root zone key set (the actual rollover event).

January 11, 2018: Revocation of old KSK.

March 22, 2018: Last day the old KSK appears in the root zone.

August 2018: Old key is deleted from equipment in both ICANN Key Management Facilities.

[0]: https://www.icann.org/resources/pages/ksk-rollover

PS - thank you for mentioning this, I wasn't aware it was going to happen until reading your comment.

Post reply on HN