DNS Provider ZoneEdit Downed By Denial Of Service Attack

Domain name service provider ZoneEdit has suffered a massive denial of service attack that has left thousands of customers with intermittent service over at least two days.

The attack, which started early Tuesday morning Eastern time and continued Wednesday, affected four of ZoneEdit's 25 domain name servers, said George DeCarlo, senior VP of marketing for Vancouver, Wash.-based Dotster, which owns ZoneEdit. "It really was a massive denial of service attack," he said.

Less than 5% of ZoneEdit's customer base was affected, but that amounts to thousands of customers, DeCarlo said. He refused to provide more specific numbers.

A domain name server, or DNS, takes a URL, such as www.companyname.com, and locates the numeric Internet address needed to find and deliver the pages hosted on a Web server. Home builder Arthur Rutenberg Homes in Clearwater, Fla., was one ZoneEdit customer whose Web site had been inaccessible since about 2 a.m. Eastern on Tuesday. The company, which operates in Florida, Georgia, and Alabama, has also had limited e-mail service as a result of ZoneEdit's problems.

"At this point we have to wait it out," said Jan Broucinek, system manager for the company. "The only option is to change domain companies, and that process can take up to 48 hours."

Potential customers often use Arthur Rutenberg Homes' Web site to get information, Broucinek said. The site gets about 15,000 visits a month and, before the home construction slump, generated about a lead a month that led to a home sale.

ZoneEdit hosts five domain names on up to two servers for customers at no charge. In advising customers about the network problems, ZoneEdit recommended that customers that needed to get back up quickly should have their domain names moved to a third server, which costs up to $10.95 a year.

"If reliable DNS service is critical for your site, we recommend logging into your account, clicking on 'Nameservers' and purchasing a 'tertiary' name server," the advisory said. "Three name servers are exponentially more reliable than two name servers."

DeCarlo said the free service doesn't have the same dedicated resources to fight DoS attacks as the paid service.

As of mid-day Wednesday, one of the four servers targeted in the DoS attack was back up. There was no estimate as to when the other machines would be running normally. "It could happen in five minutes, it could happen later on today," DeCarlo said. "They're working on it as quickly as they can."

While there's no indication of a connection, ZoneEdit hosted the domain of FastMP3Search.com.ar, an Argentine site that anti-spyware groups claimed was one of the world's worst spyware spreaders.