Could be a lot of things besides an attack, but, does appear to be a global outage of both of the authoritative servers for faa.gov for all of their various A/AAAA addresses which gov-servers lists.
Whatever is going on seems to be intermittent from querying my ISP's DNS.
Successive queries using dig have given me:
- No answer but no error for initial A record query
- SERVFAIL for ANY record query
- Valid A record response for A record query, then no answer, then a response
- Query for ANY shows some DNSSEC related records, TXT, NS, but no A record
It's weird because I wouldn't think whatever caching my ISP is doing would refresh that fast. What is the evidence this is an attack vs. a misconfiguration?
Also, would an outage like this have any impact on US flights or flights in US airspace?
Keep in mind when you query your ISPs DNS server you're probably hitting one of dozens (or more) actual servers semi-randomly. Some of them have the record cached, some don't.
The response showed the same server for at least two of the responses I described, but that's a good point. The edge server may have been querying different servers with different cached values or uncached values.
Even if you see the same response IP from your ISPs DNS server, you're still (almost definitely) hitting one of many load balanced (in some way) servers on your ISPs side.
I agree considering the responses I'm seeing from the one working server.
If I had to guess randomly at a cause, I would speculate that all their nameservers besides 155.178.199.16 are behind a load balancer that uses checking for IN A faa.gov as a health check and someone deleted that record, so, all servers fell out of the load balancer.
50c says that their method of propagating new records relies on their DNS working so someone is having a fun night fixing that.
There is some major outage going on, but it isn't the FAA. 1.1.1.1, 1.0.0.1, and 9.9.9.9 are suddenly unreachable from my part of the planet. 8.8.8.8 is, otherwise I wouldn't be able to post this. Many WWW sites that I know are behind CloudFlare are timing out. These aren't DNS issues. These are connectivity issues. The actual DNS servers themselves aren't reachable.
Of course, when it looks like most of the planet has disappeared, always suspect your ISP first. But strangely, there is intermittent connectivity to Bing, BBC News, and here.
38 comments
[ 3.3 ms ] story [ 107 ms ] threadSuccessive queries using dig have given me:
- No answer but no error for initial A record query
- SERVFAIL for ANY record query
- Valid A record response for A record query, then no answer, then a response
- Query for ANY shows some DNSSEC related records, TXT, NS, but no A record
It's weird because I wouldn't think whatever caching my ISP is doing would refresh that fast. What is the evidence this is an attack vs. a misconfiguration?
Also, would an outage like this have any impact on US flights or flights in US airspace?
What we have observed so far is intermittent issues but no root cause or intent. Operator error / system failure look more likely.
If I had to guess randomly at a cause, I would speculate that all their nameservers besides 155.178.199.16 are behind a load balancer that uses checking for IN A faa.gov as a health check and someone deleted that record, so, all servers fell out of the load balancer.
50c says that their method of propagating new records relies on their DNS working so someone is having a fun night fixing that.
All of the other NSes have been hard down, and 155.178.199.16 only seems to respond from some locations (broadly US works, International does not)
```
> dog -n 1.1.1.1 -t A faa.gov
[prints the A record]
> dog -n 8.8.8.8 -t A faa.gov
Server failure.
```
I'm guessing a lot of sites that had name-servers hosted in AS5089 might also have gone down too.
But as of 30 minutes ago, apparently it's back online.