Shared hosting mail delivery delays 12-13 October
Summary
Outgoing email from our shared hosting platform in Norway was disrupted for about 26 hours, from 12 October 2026 12:38 CEST until 13 October 2026 15:15 CEST. The cause was a failure in the external DNS resolution service operated by our data centre, not in WAYSCloud's own DNS and not in the mail service itself. No email was lost: every message accepted during the period was delivered once resolution recovered, although some arrived up to about 34 hours late.
What Happened
At 12:38 CEST on 12 October, name resolution on our shared hosting nodes in Norway began failing intermittently. The nodes could not consistently resolve the destination domains of outgoing mail, so the mail transport agent deferred delivery instead of sending.
In the same period, the external recursive DNS resolvers operated by our data centre provider experienced an extended degradation. These resolvers are infrastructure outside our own DNS platform, and the affected nodes used them for name resolution.
This was not WAYSCloud's own DNS. Our authoritative name servers remained available and continued to serve all zones correctly for the entire period. No zone we host, and no customer DNS record, was affected; the failure was in the external recursive resolution service our nodes depended on.
The failure was not specific to any customer, domain or recipient: lookups failed across many unrelated destination domains at the same time. Our investigation found no fault in the mail service itself, no fault in customer DNS records, no fault in our own DNS, and no fault in the local network.
Because resolution failed intermittently rather than completely, some messages went out normally while others accumulated in the queue. The last failed lookup was at 15:15 CEST on 13 October. The queue then drained, and the affected messages reached their recipients between 20:30 and 22:15 CEST the same evening.
We had no monitoring in place that would have detected this failure mode. The condition was identified after a customer reported missing order confirmations, and our investigation confirmed a platform-wide failure in external name resolution. This is the part of the incident we regard most seriously, and it is what we are correcting.
Impact
During the incident:
- Outgoing email from shared hosting accounts could be delayed by hours. The longest observed delay was about 34 hours.
- Outbound delivery throughput on the affected nodes fell by more than 95 percent for approximately 26 hours.
- Delay notifications generated by our own mail system during the incident could not be delivered to one sender address whose domain has no mail exchanger configured. These are system notices, not customer messages, and are handled as a separate configuration matter.
- Incoming mail was accepted normally. In a small number of cases, recipient verification of an inbound message was deferred and the sending server retried successfully.
What was not affected
No email was lost. Every message that entered the queue was delivered once name resolution recovered; no message was permanently rejected or returned to its sender because of this incident.
No mailbox data was modified or deleted. WAYSCloud's own DNS was not affected: our authoritative name servers stayed available and all zones we host continued to resolve correctly throughout the incident, and no customer DNS record was found to be at fault. DKIM signing and SPF remained in place, and recipient mail systems accepted our messages when delivery resumed. We have no evidence of unauthorised access to any system or data.
This affected shared hosting on our cPanel nodes in Norway. Other platforms were not affected.
Actions Taken
- Confirmed that the failure was in the external resolution path and not in the mail service or in our own DNS, and established the exact start and end of the window.
- Drained the queue after resolution recovered and verified delivery of every affected message.
- Replaced the resolution path on the affected nodes with a local recursive resolver, so that name resolution no longer depends on a single pair of external resolvers provided by the data centre. Public resolvers remain configured as fallback.
- Verified resolution, DNSSEC validation, blocklist lookups and mail routing after the change.
- Preserved the previous configuration so that the change can be rolled back immediately.
- Recorded the evidence and the exact time window for follow-up with the data centre provider.
Preventive Measures
- Alerting. This incident produced no alert of any kind; it was found through a customer report. Health checks for name resolution, mail queue depth and outbound delivery throughput, with paging, are being implemented so that a degradation of this kind is detected within minutes rather than hours. We consider the absence of this monitoring the main weakness exposed by the incident.
- A single point of failure outside our own DNS. Resolution on these nodes depended on one pair of external resolvers operated by our data centre. That dependency has been removed on the affected nodes and is being reviewed for the remaining shared hosting nodes.
- Verified, reversible rollout. Configuration changes to the resolution path are applied and verified per node, with a tested rollback.
- Supplier follow-up. The degradation of the data centre's external resolvers has been reported to the provider for the period, and we are tracking their findings.
- Review of notification paths. The handling of delay and failure notifications has been reviewed, including addresses that cannot receive mail.