RCA Review: Addressing Latency in the NY Region Tuesday, July 25

by Dave Raphael on Jul 25, 2023 5:48:19 PM

Today we had an incident that lasted for approximately one hour in the NYC region. I wanted to take the time to address this incident and review what happened, why it happened, what we did to resolve it, and what we’re doing to prevent future issues like this.

Impact and cause of incident

The incident began at 11:00 a.m. ET when some customers in the New York City region experienced high latency over our DNS1 Anycast network.

The cause of this incident stemmed from an issue with one of our hosting providers in which a circuit was inadvertently turned off. This resulted in DNS traffic to the Washington, D.C. region to be rerouted to servers in New York City. While this traffic shift is what we expect BGP to do in instances like this, the load was too great to resolve some requests in a timely manner. This resulted in the latency issue experienced by some of our customers.

Prior to receiving our first ticket, our team had already recognized the issue was with that particular upstream provider. We had visibility into the traffic moving from DC to NYC, and we were able to fully diagnose and solve the issues by 12:10 p.m. ET—24 minutes after our first support ticket was received.

But we’re committed to doing better. We’ve already had plans to increase our load capacity, including the NYC region, which will allow us to have greater resilience in the case of unbalanced loads resulting from unplanned traffic shifts. Our goal is to serve our customers and provide the best possible experience.

A while ago, I promised transparency, action, and accountability. I’m here to keep that promise.

Topics: DNSFilter Updates

Tycoon 2FA Infrastructure Expansion: A DNS Perspective, and Release of 65 Root Domain IOCs

Our analysis of Tycoon 2FA infrastructure has revealed significant operational changes, including the platform's coordinated expansion surge in Spanish (.es) domains starting April 7, 2025, and evidence suggesting highly targeted subdomain usage patterns. This blog shares our findings from analyzing 11,343 unique FQDNs (fully qualified domain names) and provides 65 root domain indicators of compromise (IOCs) to help network defenders implement mo...

The Best Content Filter Software Checklist: A Buyer's Guide to DNS-Level Protection

Staying Ahead with Smarter Web Filtering

Across every industry and network environment, content filtering isn’t just a matter of productivity, it’s a front line of defense. From malware and phishing to compliance risks and productivity drains, the threats are real, and the stakes are high.

Smarter DNS Policies: What You Should Be Blocking (But Probably Aren’t)

DNS filtering is a foundational layer of defense and helps to fortify the strongest security stacks. Most organizations use DNSFilter to block the obvious: malware, phishing, and adult content. That’s a great start, but many are missing out on the broader potential of DNS policies.