is there a global DNS issue happening?(faa.gov)
faa.gov
is there a global DNS issue happening?
https://faa.gov
38 comments
It looks like their DNS is not resolving. How do we know they are under attack?
https://www.faa.gov/ Works fine, most likely someone forgot to redirect the root to www
Whatever is going on seems to be intermittent from querying my ISP's DNS.
Successive queries using dig have given me:
- No answer but no error for initial A record query
- SERVFAIL for ANY record query
- Valid A record response for A record query, then no answer, then a response
- Query for ANY shows some DNSSEC related records, TXT, NS, but no A record
It's weird because I wouldn't think whatever caching my ISP is doing would refresh that fast. What is the evidence this is an attack vs. a misconfiguration?
Also, would an outage like this have any impact on US flights or flights in US airspace?
Successive queries using dig have given me:
- No answer but no error for initial A record query
- SERVFAIL for ANY record query
- Valid A record response for A record query, then no answer, then a response
- Query for ANY shows some DNSSEC related records, TXT, NS, but no A record
It's weird because I wouldn't think whatever caching my ISP is doing would refresh that fast. What is the evidence this is an attack vs. a misconfiguration?
Also, would an outage like this have any impact on US flights or flights in US airspace?
Keep in mind when you query your ISPs DNS server you're probably hitting one of dozens (or more) actual servers semi-randomly. Some of them have the record cached, some don't.
The response showed the same server for at least two of the responses I described, but that's a good point. The edge server may have been querying different servers with different cached values or uncached values.
Even if you see the same response IP from your ISPs DNS server, you're still (almost definitely) hitting one of many load balanced (in some way) servers on your ISPs side.
There is some major outage going on, but it isn't the FAA. 1.1.1.1, 1.0.0.1, and 9.9.9.9 are suddenly unreachable from my part of the planet. 8.8.8.8 is, otherwise I wouldn't be able to post this. Many WWW sites that I know are behind CloudFlare are timing out. These aren't DNS issues. These are connectivity issues. The actual DNS servers themselves aren't reachable.
Of course, when it looks like most of the planet has disappeared, always suspect your ISP first. But strangely, there is intermittent connectivity to Bing, BBC News, and here.
It's potentially related to the outage at Virgin Media (AS5089) in the United Kingdom, see https://twitter.com/CloudflareRadar/status/16430702601305047....
I'm guessing a lot of sites that had name-servers hosted in AS5089 might also have gone down too.
But as of 30 minutes ago, apparently it's back online.
I'm guessing a lot of sites that had name-servers hosted in AS5089 might also have gone down too.
But as of 30 minutes ago, apparently it's back online.
not seeing anything about this in the news yet.
I see 155.178.199.16 now intermittently responding.
All of the other NSes have been hard down, and 155.178.199.16 only seems to respond from some locations (broadly US works, International does not)
All of the other NSes have been hard down, and 155.178.199.16 only seems to respond from some locations (broadly US works, International does not)
Inspecting the result for `faa.gov` from 155.178.199.16 is interesting:
; <<>> DiG 9.11.5-P4-5.1+deb10u8-Debian <<>> +noedns faa.gov @155.178.199.16
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28118
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;faa.gov. IN A
;; AUTHORITY SECTION:
faa.gov. 300 IN SOA faa-mc-igms.faa.gov. helpdesk.faa.gov. 172720 10800 1080 2419200 300
;; Query time: 558 msec
;; SERVER: 155.178.199.16#53(155.178.199.16)
;; WHEN: Tue Apr 04 02:47:54 UTC 2023
;; MSG SIZE rcvd: 82
;; QUESTION SECTION:
;www.faa.gov. IN A
;; ANSWER SECTION:
www.faa.gov. 600 IN CNAME www.faa.gov.edgekey.net.It's always DNS
I add some NS records for different s domains at GoDaddy and Gandi an they are not being propagated.
This is happening from las Friday
It works with www. at the beginning.
https://www.faa.gov/
[deleted]
[deleted]
Do we have any source for the current title claim ("FAA DNS is under attack")?
What we have observed so far is intermittent issues but no root cause or intent. Operator error / system failure look more likely.
What we have observed so far is intermittent issues but no root cause or intent. Operator error / system failure look more likely.
I agree considering the responses I'm seeing from the one working server.
If I had to guess randomly at a cause, I would speculate that all their nameservers besides 155.178.199.16 are behind a load balancer that uses checking for IN A faa.gov as a health check and someone deleted that record, so, all servers fell out of the load balancer.
50c says that their method of propagating new records relies on their DNS working so someone is having a fun night fixing that.
If I had to guess randomly at a cause, I would speculate that all their nameservers besides 155.178.199.16 are behind a load balancer that uses checking for IN A faa.gov as a health check and someone deleted that record, so, all servers fell out of the load balancer.
50c says that their method of propagating new records relies on their DNS working so someone is having a fun night fixing that.
hear me now and believe me later.
Could be a lot of things besides an attack, but, does appear to be a global outage of both of the authoritative servers for faa.gov for all of their various A/AAAA addresses which gov-servers lists.
[deleted]
Seems to be unresolvable globally: https://www.whatsmydns.net/#A/faa.gov
what is this site called again? some folks would do good to google "jvns.ca dns"
```
> dog -n 1.1.1.1 -t A faa.gov
[prints the A record]
> dog -n 8.8.8.8 -t A faa.gov
Server failure.
```
```
> dog -n 1.1.1.1 -t A faa.gov
[prints the A record]
> dog -n 8.8.8.8 -t A faa.gov
Server failure.
```
It is fixed now
Doesn't load for me.
Idk what to say, it didn't load for a while and now it is. If I could upload screenshot to prove it I would.
I get "site can't be reached".