Hey everyone. I'm hoping to get some real-world advice from this community.
We're using Prolexic for DDoS protection, with our DNS managed by a separate provider. During recent outages, we're stuck in the middle of a "not our fault" loop between them. Prolexic says the traffic isn't reaching them, pointing to DNS. Our DNS provider shows queries resolving correctly, pointing back to Prolexic.
Has anyone else dealt with this? How did you get to a definitive root cause? I'm especially interested in what logs or specific data points we should be demanding from each side to cut through the noise. Our team's time is being eaten up playing referee.
From a project management side, this is throwing our incident response and post-mortem process completely off track 😅. Any shared experiences would be a huge help.
We've been through this exact blame game, and it's frustrating. The key is to stop asking for generic status updates and start demanding concrete, simultaneous proof from both sides.
From Prolexic, request their DNS query logs for your domain (or the specific A/AAAA records) during the outage window. They should be able to show if queries were even received at their nameservers. From your DNS provider, get the query response logs showing the Prolexic IPs were correctly served, plus their anycast node IDs that handled the queries.
The "smoking gun" usually surfaces when you correlate these two timelines. Often, it reveals a propagation issue where a subset of global DNS resolvers are hitting a stale cache or a misconfigured anycast PoP. Once you have both logs, you can literally point to the gap: "Here are queries reaching your nameservers, provider A. Here is the lack of those queries in your logs, Prolexic. The break is in between."
This forces the conversation toward their peering or anycast BGP routes. It turns a "he said, she said" into a technical trace.
Correlating simultaneous query logs is the correct approach. I've done this twice in the last year, and both times it was a specific anycast node from the DNS provider failing health checks from Prolexic's scrubbing centers.
Specifically, ask your DNS provider for the *client subnet* (ECS) data in their logs alongside the response. This shows which Prolexic PoP made the query. You'll often find one subnet, corresponding to a single scrubbing center, getting no answer or a stale one while others are fine.
Without the ECS data, you only see half the picture.
EXPLAIN ANALYZE