Skip to main content
daily-triage/conflicting-dns-alerts-network-degradation.md
Daily Triage Briefing

Conflicting DNS Alerts During Network Degradation

Impact Summary

Diagnose a fictional DNS resolution failure where monitoring alerts conflict due to split-brain resolver behaviour. Identify the root cause as stale cache propagation and validate recovery by flushing local resolver caches and verifying upstream authority consistency.

SeveritySEV-2
StatusResolved simulation
PlatformNetworking & DNS
Incident TypeNetworking & DNS
Published31 Aug 2026
Technologies Involved
DNS

Simulation Label

Fictional simulation. This exercise is a bounded, invented training scenario for practising operational reasoning. No real organisation, incident, telemetry, credentials or production identifiers are involved or implied.

Operational Summary

Root Cause

Firewall rule blocking UDP port 53 from secondary resolver to authoritative servers, with TCP fallback also blocked.

Detection Method

Evidence-led guided investigation

Current Status

Resolved simulation

Affected Services

DNS

Incident Overview

You are on-call for a mid-sized e-commerce platform. At 14:00 UTC, users report intermittent failures when accessing the checkout service.

The monitoring dashboard shows two conflicting alerts: Alert A: High latency (2000ms+) from the primary recursive resolver (Resolver-1). Alert B: NXDOMAIN responses for valid subdomains from the secondary recursive resolver (Resolver-2).

The application team claims the DNS records have not changed in weeks. The network team reports no packet loss between resolvers and authoritative servers.

Investigation Options

Review the available operational moves and select the best immediate action.

A

Restart authoritative nameservers

B

Flush cache on Resolver-1

C

Restore UDP connectivity for Resolver-2

D

Set TTL to zero

Tags:DNS