This report explains the nature and impact of the incident.
The queries were well-formed, valid DNS messages for a single domain name.
The elevated traffic levels continued until approximately 09:30 UTC.
The event traffic continued until 06:10 UTC.
Most, but not all, DNS root name server letters received the query load.
DNS root name servers that use IP anycast observed this traffic at a significant number of anycast sites.
The source addresses of these particular queries appear to be randomized and distributed throughout the IPv4 address space.
The observed traffic volume due second, per DNS root name server letter receiving the traffic.
Impact of Traffic
The incident traffic saturated data pipe connections near some DNS root name server instances.
This resulted in timeouts for valid, normal queries to some DNS root name servers from some locations.
