Cases4 cases

1 to 4 of 4

1. IL-0502 The JupyterHub at temple.2i2c.cloud stopped resolving in DNS after a wildcard record was added for a new cluster

   2i2c2025

   Symptoms

   On 20 August 2025 at 10:02 AM Pacific time, an automated uptime check on temple.2i2c.cloud started failing and paged 2i2c: the JupyterHub at temple.2i2c.cloud could not be reached, shortly before the community that uses it was to give a demo.

   DNS resolution failuresService outage

   Trigger

   At 9:21 AM, while setting up a new cluster for Temple, a wildcard DNS record *.temple.2i2c.cloud was added pointing to the new cluster's Ingress IP.

   Root cause

   Configuration change

   Component

   Authoritative DNS servers and records

   Contributing factor

   Unverified assumptionCache-masked failureUnreviewed defaults

   Detection

   Automated uptime alerts caught the failure at 10:02 AM, before the community reported it in a support ticket at 10:09 AM.

   Remediation

   • Added an explicit A record for temple.2i2c.cloud in Namecheap
   • Lowered the DNS TTL from the 30-minute default to 5 minutes
   • Offered the community member running the demo an /etc/hosts entry as a workaround

   Action items

   • Give everyone on the team access to Namecheap, or move to another DNS provider
   • Use a 5-minute TTL instead of 30 minutes for all new DNS entries
   • Document that adding a *.X.2i2c.cloud DNS entry requires adding an X.2i2c.cloud entry as well

   Lessons

   Adding a wildcard record for a subdomain stopped a broader wildcard from answering for that subdomain's own name, so a *.X.2i2c.cloud record needs an X.2i2c.cloud record alongside it. The 30-minute default TTL at Namecheap meant any DNS fix could take that long to propagate, and the engineer creating the original record had no access to the DNS provider.

   View case
2. IL-0533 Names in chinacloudapp.cn and chinacloudsites.cn stopped resolving as DNS caches expired, breaking Azure China services

   Microsoft Azure2024

   Symptoms

   From 03:45 CST on 23 April 2024, FQDNs in two system domains of Azure in China, chinacloudapp.cn and chinacloudsites.cn, gradually stopped resolving, and customers in the Azure China regions had trouble connecting to many Azure services and managing resources. Internal monitors alerted engineers to the degradation at 04:37 CST.

   DNS resolution failuresHigh error rateMonitoring outage

   Trigger

   At 03:45 CST a configuration change made through a domain registrar, as a step of a domain decommissioning workflow, updated the nameservers of chinacloudapp.cn and chinacloudsites.cn to a set of inactive servers.

   Root cause

   Configuration change

   Component

   Authoritative DNS servers and records

   Contributing factor

   Unverified assumptionCache-masked failure

   Detection

   Internal monitors alerted engineers to the degradation in the Azure China Cloud at 04:37 CST and created an incident, which the engineering team acknowledged at 04:39 CST.

   Remediation

   • Reverted the two domains to their previous working nameservers

   Action items

   • Suspended further runs of the domain lifecycle process until the management tool covers Azure in China
   • Make the validation process of domain lifecycle management include signals from all cloud regions
   • Add validations that get nameserver information by resolving the zone directly over the Internet

   View case
3. IL-0254 Square's internal DNS servers failed and Square products, services and payments were unavailable for about 15 hours

   Square2023

   Symptoms

   From 1:54 PM ET on 7 September 2023, Square products and services were unavailable, and at 2:02 PM ET engineers were notified of infrastructure issues and began investigating DNS. Square Online websites stayed up, but their customers could not make payments.

   DNS resolution failuresService outage

   Trigger

   At 11:04 AM ET a host-based firewall rule change was deployed to enable region communication, which increased the size of the firewall rules on nodes. Combined with a DNS service upgrade, it put unexpected load on the internal DNS servers. The timeline also lists a DNS zone change at 1:56 PM ET.

   Root cause

   Configuration change

   Component

   Authoritative DNS servers and recordsNode iptables rules

   Contributing factor

   No staged rolloutCache-masked failureCircular dependency

   Detection

   Engineers were notified of infrastructure issues at 2:02 PM ET, eight minutes after services became unavailable.

   Remediation

   • Shed network traffic to the DNS servers and started bringing up new DNS servers by hand
   • Deployed networking changes by hand to re-enable the authorization and access services
   • Deployed the networking changes by hand to all data centers
   • Rebuilt the DNS servers
   • Built a new configuration from the reverted firewall ruleset and pushed it to the DNS hosts

   Action items

   • Move the DNS infrastructure onto isolated infrastructure
   • Add monitoring and optimizations for critical networking infrastructure
   • Optimize dependencies between the deploy and platform infrastructure where feasible
   • Expand support for Offline Mode and improve communication about when it is available

   View case
4. IL-0363 static.crates.io did not resolve for 10-15 minutes during a Terraform deployment, so Rust builds could not fetch crates

   Rust Project2023

   Symptoms

   On 25 January 2023, shortly after a deployment to the crates.io production infrastructure at 09:15 UTC, the DNS record for static.crates.io failed to resolve for an estimated 10-15 minutes. Builds failed for users because crates could not be downloaded.

   DNS resolution failures

   Trigger

   A Terraform deployment to production contained a new TLS certificate for the current CDN of static.crates.io and updated DNS records; Terraform removed the current certificate and DNS records first and recreated the records only after the new certificate had been issued.

   Root cause

   Configuration change

   Component

   TerraformAuthoritative DNS servers and recordsCDN and edge network

   Contributing factor

   No safeguard on destructive changeUnrepresentative staging

   Remediation

   • Terraform finished the deployment and created a new DNS record for static.crates.io, which ended the outage

   Action items

   • Document the process of deploying changes to production, including how to pick the Git commit and how to review the changeset
   • Deploy changes developed and tested in isolation on staging individually and in sequence to production, and add this to the documentation
   • Deploy changes to production when they are merged into the main branch, so the configuration in Git and what is deployed do not drift

   Lessons

   Deploying the TLS certificate change and the DNS record change separately would have avoided the outage. Changes tested one at a time on staging need to reach production one at a time and in order, the production deploy process needs to be written down so it can be improved, and merged changes need to be deployed promptly so Git and production do not drift apart.

   View case

By root cause1