gshaw Posted February 23, 2018 Posted February 23, 2018 (edited) Just had users phone in reporting issues with Office 365 login on our internal machines (white page stuck when trying to access login.microsoftonline.com) By process of elimination we switched back to the Google 8.8.8.8 Forwarder and that seems to have resolved it. Also just found this https://expertbrains.in/2018/02/05/dns-stops-you-to-open-websites/ which suggests Quad9 could well be at fault. Anyone else experiencing the same? We also noticed that Quad9 returns different results for a DNS query to login.microsoftonline.com - Google returns 4 IP addresses but Quad9 only returns 2, can anyone else confirm? @Arthur @Bob_the_Goon @kjadams @limawhiskey noticed you're all using it from the thread http://www.edugeek.net/forums/security/190463-ibm-quad9-free-global-dns-resolution-service-protect-against-cyber-threats-2.html - noticed any issues this morning? Edited February 23, 2018 by gshaw
philro Posted February 23, 2018 Posted February 23, 2018 Just had a similar issue with ClassCharts/SIMS Options Our filtering (Lightspeed) has categorised https://secure.aadcdn.microsoftonline-p.com as malware - changed it to allow and everything is now working. Hopefully this might help you?
Katy Posted February 23, 2018 Posted February 23, 2018 (edited) I have the same problem - google resolves it but quad9 doesn't. The domain stopping it working for us is secure.aadcdn.microsoftonline-p.com which appears to host all the javascript/CSS etc for 365. However when I looked into it, none of the MS dns servers resolved it either (and as it's their domain they should be doing - ns1-4.msft.net). Which leads me to believe it only works through google etc because they are caching the result and it'll probably fall over for everybody once the cache expires. nslookup secure.aadcdn.microsoftonline-p.com ns1.msft.net Server: ns1.msft.net Address: 208.84.0.53 Name: secure.aadcdn.microsoftonline-p.com Edited February 23, 2018 by Katy
mrbios Posted February 23, 2018 Posted February 23, 2018 Same here! Thought i'd broken my ADFS server yesterday, as i updated my WIASupportUserAgents and now this problem today. Thank you for pointing this out!
Katy Posted February 23, 2018 Posted February 23, 2018 Thought i'd broken my ADFS server yesterday, Me too! I moved my ADFS server from our old to new connection/IP range yesterday, so when this happens.... all you can think is "what have I done"
Bob_the_Goon Posted February 23, 2018 Posted February 23, 2018 Yes. We've been seeing that issue this morning too. I've just added in 8.8.8.8 and it appears to be working again.
gshaw Posted February 23, 2018 Author Posted February 23, 2018 Interesting, thanks all for the responses... I'm not going mad then! That secure.aadcdn.microsoftonline-p.com address sounds about right as when the login page was part loading it was missing background images, svgs etc. that had at least part of that URL in the name. The Google cache theory is particularly interesting, really sloppy from MS if they've dropped a domain without taking the effects on DNS into account.
Bob_the_Goon Posted February 23, 2018 Posted February 23, 2018 I've checked the O365 admin console to see if there are any advisories surrounding this issue but I can't see any. There seems to be a spike in O365 issues reported on downdetector.co.uk at the moment.
gshaw Posted February 23, 2018 Author Posted February 23, 2018 I've checked the O365 admin console to see if there are any advisories surrounding this issue but I can't see any. There seems to be a spike in O365 issues reported on downdetector.co.uk at the moment. In true MS fashion they'll admit to it 4-6 hours later then say the issue is resolved while it's still going on (!)
senanf Posted February 23, 2018 Posted February 23, 2018 (edited) FYI This is why Quad9 have had issues with Office365 "One of our TI providers, PhishTank, incorrectly reported it (Office365) as a phishing domain - we are in the process of removing it from our zone files and pushing a update." Edited February 23, 2018 by senanf 3
senanf Posted February 23, 2018 Posted February 23, 2018 Hopefully fixed, fyi for anyone else that comes across this thread [TABLE=width: 100%] [TR] [TD](Quad9) Feb 23, 10:23 AST Senan- This issue should now be resolved. PhishTank was reporting several false positives in their latest update including www.google.de, www.google,ca and secure.aadcdn.microsoftonline-p.com. While secure.aadcdn.microsoftonline-p.com is not immediately obvious as a false positive it is used for the login process for Office365. We will be following up with them as well as taking precautions on our side to make sure that these false positives do not reoccur. We are sorry for the inconvenience. Thanks,[/TD] [/TR] [/TABLE] 2
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now