DNS servers removing non-compliant DNS implementations on or around 1st February 2019 - DNS Flag Day - Support and Troubleshooting

DNS servers removing non-compliant DNS implementations on or around 1st February 2019 - DNS Flag Day Issue  DNS servers have agreed to removing non-compliant DNS implementations from their services, on or around February 1st 2019. This is called DNS Flag Day.

Changes to global DNS infrastructure on the internet will take place to properly support EDNS (Extension mechanisms for DNS) instead of previous multiple mitigations and workarounds done for DNS functionality and name resolution.

This change will make most DNS operations slightly more efficient, and also allow operators to deploy new functionality, including new mechanisms to protect against DDoS attacks.

Symptoms You can recognize this problem because your URL does not resolve correctly as follow:

When opening the URL on your browser: , it will timeout, and The problem started after February 1st, and Your browser might explain the "host" could not be resolved, and Connecting directly to the .service-now.com works correctly. To validate if you are affected, a free tool is available to test if your DNS domain name and its DNS Server is compatible with EDNS - https://ednscomp.isc.org/ednscomp

Cause On or around Feb 1st, 2019, major open source resolver vendors will release updates that will stop accommodating non-standard responses.

Sites hosted on incompatible authoritative servers may become unreachable through updated resolvers.

Resolution Test on the site https://dnsflagday.net/ and confirm the .service-now.com *is* compliant.

If you have your own DNS redirections to the instance, or reverse proxies, please test them as well. Customers (e.g. ones using vanity url domains) are responsible for ensuring their own DNS domains are compliant.

Additional Information Normal access to the instances should work as usual.

If you use a custom domain or reverse proxy to the instance, they needs to also be compliant as well. If your custom URL DNS record is not compliant, you will be able to access the instance through the original URL, but not through the custom url.

If the domain you point the instance to is , please note that this could have issues on 1st of February. Unless you correct this - the custom URL will not work, but the instance will work using the instance name.

Note : Please note this is not a ServiceNow issue. Customers (e.g. ones using vanity domains) are responsible for ensuring their own DNS domains are compliant.

More information here:

https://dnsflagday.net/ https://www.isc.org/blogs/dns-flag-day/ If you are impacted, please contact the DNS administrator of the affected domains and ask them to review the DNS entries for your custom domains or reverse proxies.