When a DNS Provider Goes Down

What happened on Friday

Last Friday, many well-known websites could not be reached for hours in parts of North America. Their servers were running. Visitors simply could not find them.

The cause was an attack on a company that answers DNS lookups for a great many websites. A botnet of hacked cameras and video recorders, many still on their factory passwords, flooded it with junk traffic.

While the flood lasted, genuine lookups went unanswered, and the sites relying on that provider dropped out of reach.

Small business sites were not the target. But the same failure can happen to any domain, for duller reasons, and few owners know where their own DNS lives.

What DNS does

Every website sits on a server with a numeric address. DNS, the domain name system, is the directory that turns your domain name into that number.

When someone types your address, their device asks a resolver, usually run by their internet provider. The resolver asks the name servers responsible for your domain, and they answer.

Those name servers are listed in your domain's registration. They may be run by your registrar, your web host or a dedicated DNS company, and they hold the records for the website, the email and everything else.

If they cannot answer, nothing on the domain can be found, however healthy the server.

Why the site can be fine and still unreachable

• The web server is up and serving pages.
• The host's status page shows everything working.
• Anyone who looked you up recently may still get through.
• Everyone else sees an error saying the site cannot be found.
• Email to your domain starts to queue, then bounce.

The third explains the confusing reports during an outage. Resolvers remember answers for a set time, so a visitor whose resolver asked an hour ago may still reach you while a new visitor cannot.

What it does to email

Email depends on DNS too. Sending servers look up your domain's mail records to find out where to deliver.

When those lookups fail, most sending servers hold the message and try again, often for a day or more, so a short outage holds up email rather than losing it. A long one sends messages back as undeliverable.

This catches businesses whose email is with Office 365 or G Suite but whose DNS sits with the web host. If the host has a bad day, the email goes with it.

Find out where your DNS lives

Most owners do not know who answers lookups for their domain, and whoever set it up may be long gone.

The registrar's control panel, or a public lookup of the domain, shows the name servers. Their names usually reveal the company.

Then check who can log in to change the records. It should be an account the business owns, with a strong password, two-step verification where offered, and more than one person who knows about it.

Write it all down. It is the page you will want during an outage.

A better provider, and perhaps a second

For most small businesses the biggest improvement is a DNS provider built for the job: one that runs name servers in many places on separate networks, so one flooded location does not stop answers elsewhere.

Ask yours where its name servers are and what happens if one location goes down. A provider that cannot answer clearly is telling you something.

Friday showed the limit of any single provider. Secondary DNS adds name servers from a second, independent company holding a copy of the same records, so if one cannot answer, resolvers ask the other.

The cost is coordination: every change has to reach both copies. It is worth it where an hour offline has a real price, such as online ordering or bookings. For a brochure site, one good provider is enough.

Sensible settings

Every DNS record carries a time to live, or TTL: how long resolvers may remember the answer before asking again.

Short TTLs of a few minutes are useful just before moving a site, so the change spreads quickly. Left in place afterwards, they mean that minutes into an outage, almost nobody can find you.

A TTL of a few hours lets visitors whose resolvers already know your address keep reaching you through a short outage. For records that rarely change, that is the better default.

Check yours, especially if the site has ever moved hosts.

A worked example

A Thai restaurant with a takeout counter takes a good part of its weekend orders through an ordering page on its own website.

One Friday evening last winter, the page stopped loading for most customers. The host's support line said the server was working, which was true.

The DNS was still with the registrar where the original designer had bought the domain, on a basic service that went down for about two hours.

Its records also carried a five-minute TTL, set years earlier for a move between hosts and never changed back. Within minutes almost every customer lost the site, and email to the restaurant sat in queues.

The owner moved the DNS to a provider with name servers in several locations, under a login the restaurant controls, and raised the TTLs to a few hours.

The phone number and menu link on its Google listing and Facebook page, which do not depend on its domain, were checked too.

The counter-case

For most small businesses, an attack like Friday's is not the main risk.

The larger risks are ordinary: DNS nobody can log in to, records changed by mistake, a domain that lapses because the renewal notice went to an old address.

A site that takes no orders and books nothing can live with an occasional hour offline, and does not need two providers.

But every business should know where its DNS lives, who controls it and how its records are set, because an outage nobody at the business can act on lasts longest.

Before the next DNS outage

1. Look up your name servers and note the company.
2. Confirm who can log in to change records.
3. Add two-step verification to that login.
4. Check your TTLs on website and mail records.
5. Ask your provider how its name servers are spread.
6. Consider secondary DNS if you take orders online.
7. Keep your phone number current on your listings.

Step two matters most. Every other improvement depends on someone at the business being able to reach the settings, and an outage is no time to find out who that is.

Checking a site on a new server before the DNS is switched is covered in the temporary address a new host gives you.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.