[outages] Scattered DNS issues

[Joe Abley]

On 2013-08-14, at 10:24, "J. Oquendo" <sil at infiltrated.net> wrote:

> Sites timing out, not resolving one minute, then resolving
> the next. E.g. here is another instance:
> 
> https://twitter.com/briankrebs/status/367641489498992640
> 
> His site passes through Global/Level3, I couldn't reach
> him with GBLX/Level3 DNS, but could with 8.8.8.8 his site
> appeared down from downforeveryoneorjustme.com but was
> resolvable in some instances.

krebsonsecurity.com is delegated to ns1.prolexic.com and ns2.prolexic.com.

I'm seeing both those nameservers respond with non-authoritative answers for krebsonsecurity.com/IN/SOA.

Jakob's robot seems to see similarly:

  http://dnscheck.se/log.pl?domain=krebsonsecurity.com&date=last

So does AFNIC's, at least some of the time:

  http://www.zonecheck.fr/zonecheck/cgi-bin/zc.cgi?zone=krebsonsecurity.com

Those prolexic nameservers are surely anycast; it seems possible that they have a problem where some of their nodes are serving the zone accurately and some are not. That seems consistent with the kind of unpredictable results you're describing.

If there was a problem with the zone or the servers that are serving it, it's quite possible that it has since been fixed and what you're seeing is fallout from cached bad answers.


Joe