12 ms·
5 out of 7 .io nameservers appear to be down
- sajal83 11y agohttps://pulse.turbobytes.com/results/5595115aecbe406935000175/ https://pulse.turbobytes.com/results/5595115aecbe40693500017... better link to show that its not a local resolver issue.
- jlgaddis 11y ago... and the two remaining nameservers look to be run by the same organization; the /16 that they both reside in (49.212/16) is being announced by "Sakura Internet" (AS9371). It looks like they do have multiple upstreams, though.
- buster 11y agoAnd yet the internet keeps working.. :) Docker.io still resolves for me, and i guess many others do?
- sajal83 11y agoevery y out of x times a DNS recursor will fail to resolve .io .... ratio of y:x is based on complex srtt algorithms, and traffic levels. Not a big issue for popular hostnames like docker.io because most recursives would have the delegation in their cache.
- nly 11y agoCaching is great isn't it.
- jasoncartwright 11y ago"The dark side of .io: How the U.K. is making web domain profits from a shady Cold War land deal" https://gigaom.com/2014/06/30/the-dark-side-of-io-how-the-u-k-is-making-web-domain-profits-from-a-shady-cold-war-land-deal/ https://gigaom.com/2014/06/30/the-dark-side-of-io-how-the-u-...
- teknologist 11y agoI think I trust even an ICB root server more than I'd trust one running on that island
- MichaelGG 11y agoThat's so stupid. If some islanders had their own gTLD, it wouldn't be .io. It's not like it's some natural right that belongs to the island or the peoples. Chagos Island? So they'd have .cg or something like that. Not so valuable eh?
- sena 11y agohttps://gigaom.com/2014/06/30/the-dark-side-of-io-how-the-u-k-is-making-web-domain-profits-from-a-shady-cold-war-land-deal/ https://gigaom.com/2014/06/30/the-dark-side-of-io-how-the-u-... "The rights for selling .io domains are held by a British company called Internet Computer Bureau (ICB), [...] The British government granted these rights to ICB chief Paul Kane back in the 1990s. ICB gets to run .io “more or less indefinitely, unless we make a technical mistake,” Kane told me. (ICB has so far run a stable .io namespace. It should be noted that Kane is a respected veteran of the infrastructure scene, and has been entrusted by ICANN with one of the 7 so-called “keys to the internet”.)" Ooops...
- benguild 11y agoSo, this mistake might cost him the rights?
- jlgaddis 11y agoWhat's the mistake? The reason there are multiple DNS servers is in case one/some of them have problems. There are two other root servers for the .io. zone that are apparently functioning just fine. That means the overall system is working as intended, no? Also, I don't think we know (yet) why five of the seven are down. If it turns out to be some "amateur hour" mistake then, sure, I could see it being used against ICB. If, however, the underlying issue is/was out of their control, then why should they be penalized? ETA: It appears that the name servers are actually "up". They respond to ICMP echo requests but aren't answering queries: $ ping -q -c 5 a.nic.io PING a.nic.io (64.251.31.179): 56 data bytes --- a.nic.io ping statistics --- 5 packets transmitted, 5 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 45.123/45.283/45.453/0.106 ms $ dig ns docker.io @a.nic.io ; <<>> DiG 9.10.2 <<>> ns docker.io @a.nic.io ;; global options: +cmd ;; connection timed out; no servers could be reached
- falcolas 11y agoTo be fair, even if it was "amateur hour", it was apparently mitigated by practices which kept two of the seven up. I've watched other companies do far worse.
- rikkus 11y agoI was already slightly concerned about using getting a .cc domain for my email address, due to it being a 'lesser' TLD and thinking this sort of thing might happen. Are there ways to mitigate this risk in general, or is it something we generally have to accept if we're not choosing .com domains?
- jand 11y agoi can just see the option to avoid TLDs which "belong" to companies acting in volatile markets... which may be indeed of concern with all those fancy new generic TLDs. i would welcome better proposals, too.
- josephmx 11y agoI think (but don't hold me to it), that country-ran (eg, .co.uk, .us) or major TLDs are safe (eg, .net, org)
- betaby 11y agoWell, happens with .se. in the past http://securityandthe.net/2009/10/13/se-domains-offline/ http://securityandthe.net/2009/10/13/se-domains-offline/ and other tlds as well.
- billyhoffman 11y agoI don't understand what you mean by "country-ran." .us and .uk are ccTLDs, meaning they were created and recognized 2-3 decades ago by ICANN based on ISO country and Territory codes. ccTLSs are among the oldest continually operating TLDs. In fact, .io is a ccTLD. But that doesn't make them "run by a country". .us is not run by the US government. It is run by Neustar. There is not something that says Neustar won't have poorly available/slow name servers, beyond that same statement that the .io people said.
- josephmx 11y agoI was under the impression that ccTLDs are administered/ran by the country they belong to (eg, I thought .us was administered by the US government). It sounds like I'm wrong though, my bad.
- poooogles 11y ago5 out of 7 have been down for ages, literally ages.
- bhouston 11y agoHow do you know?
- OedipusRex 11y agoNot sure if this is what OP is getting at but I do believe some of these .io domains are failed projects that are no longer pointing to an active web server.
- blackoil 11y agoThese are tld servers, not domains. TLD server are root dns servers, acting as source of truth for the domain names.
- kijeda 11y agoNo, a root server is shorthand for the authoritative name servers that serve the root zone of the DNS. Here is the list: http://www.iana.org/domains/root/servers http://www.iana.org/domains/root/servers Servers configured to be a source of truth are called "authoritative name servers". There is no technical distinction between "TLDs" and "domains", they are all just domains, they are just different levels of the DNS hierarchy.
- poooogles 11y agoDid some research myself a while ago, no source other than my word I'm afraid.
- svckr 11y agoAm I the only one who noticed the mustache templates in <title>-tag while the page was loading?
- sajal83 11y agoThats angularjs template... We need to put in some placeholder there.
- artur_makly 11y agoWe seem to be POPing : http:/popteam.io
- hopeless 11y agoIs there a table of TLD's ranked by nameserver reliability? It seems like a useful thing for those of considering something more exotic
- jlgaddis 11y agoI don't personally know of one (which isn't saying much) but that sounds like an interesting thing to monitor. Maybe an HN'er who has written their own monitoring system (and provides it as a paid service) could begin monitoring queries/responses from the many TLD root name servers.
- josteink 11y agoBut a .io domain sure hip! Can't go with something boring or traditional like .com, .net or .org ;)
- ianlevesque 11y agoThat's because anything halfway human readable is taken under those TLDs.
- icebraining 11y agoThere are plenty of human readable domains available, they're just long.
- xnzakg 11y ago"i/o timeout" That's ironic.
- logicrime 11y agoWhat if the actual indian ocean timed out? That'd suck.
- halviti 11y agoFrom your previous comment complaining about HN: "The internet doesn't need another reddit, it's bad enough as it is." Yet you insist on making comments that only belong on reddit. Can I convince you to delete your account?
- deleted 11y ago[deleted]
- thirdreplicator 11y agoI hope this is costing them lots of money for fucking up.
- lewisheadden 11y agoThey actually seem to work fine but you have to set the non-recursive bit. $ dig ns io @b.nic.ac +short ; <<>> DiG 9.8.3-P1 <<>> ns io @b.nic.ac +short ;; global options: +cmd ;; connection timed out; no servers could be reached $ dig ns io @b.nic.ac +short +norec b.ns13.net. [... extracted for brevity] ns3.icb.co.uk.
- kijeda 11y agoThis is the correct answer. The monitoring tool is sending the wrong kind of DNS queries to these servers, and these servers are filtering them out. You can argue the servers should at least respond with an error, however they are functioning correctly when you ask them for an authoritative response (i.e. a delegation)
- sajal83 11y ago(monitoring tool author here) Agree. Makes sense. We should have run this test with RD bit unset. But .. IIRC if RD is set when quering a non-recursive, it should respond normally with authoritative response Recursion Available (RA) flag unset. It does not mean it should drop the query totally.
- jamiesonbecker 11y agoDropping bad queries is often a DDoS countermeasure.
- skion 11y agoThis is indeed a typical configuration for authoritative name servers.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- Ken-B 11y agoThere's a good 2004 documentary by famous film maker John Pilger on the topic of Chagos: "Stealing A Nation". Fully available on youtube, about 1h long: https://www.youtube.com/watch?v=0zhGvId4fcc https://www.youtube.com/watch?v=0zhGvId4fcc It seems that now also startup companies are (unwillingly, I presume) contributing to this lasting injustice.
- bezalmighty 11y agoMy .io has been up and down about 25 times in the last 15 hours. The downtime has been about 1.0 - 2.5 minutes each occasion, with a down period of 1 hour 48 minutes at the start. The latter downtimes look planned, as they are for exact periods (1 minute 0 seconds, 1 minute 30 seconds, 2 minutes 30 seconds, etc) Here's an extract from the log with timing incase anyone's interested: https://gist.github.com/anonymous/ed37826bc66c23d6c791 https://gist.github.com/anonymous/ed37826bc66c23d6c791
- jlgaddis 11y agoWhat are you using for monitoring / what generated these logs? Unless your monitor is attempting a connection every, e.g., one second, you're going to end up with the "exact periods" you describe (i.e., presumably your monitor is only attempting to connect once every 30s). Also, this would be more indicative of a problem with your web host, not the .io root name servers, assuming the TTLs on your RRs are set to > 30s.
- emilburzo 11y agoThe message format looks like something from UptimeRobot.
- mrintegrity 11y agoI own a 2 letter .io domain and frankly have no use for it whatsoever.. perhaps I should do some kind of startup company..
- deleted 11y ago[deleted]