We are publishing this Public Incident Review following the DNS outage and degradation that affected .ZA commercial second-level domains between 6 and 14 March 2025.

This report was originally finalised on 20 May 2025 following the DNS outage and degradation experienced in March 2025, and was prepared for limited distribution to key stakeholders. At the time of its completion, the report was provided to the ZA Domain Name Authority (ZADNA) and the relevant public authorities. Owing to the ongoing technical review and associated security-related investigations being undertaken at the time, wider publication of the report was deferred pending the conclusion of those processes.

Since the incident, ZARC has continued to analyse operational telemetry, implement infrastructure and operational improvements, and incorporate the lessons learned into the ongoing evolution of its DNS architecture, operational procedures and resilience planning. This work has strengthened both the robustness of the Shared Registry System (SRS) and the registry’s preparedness for future operational events. Following requests from accredited registrars and members of the Internet Service Providers’ Association (ISPA) Domain Name Working Group, and with the agreement of the ZA Domain Name Authority, this report is now being released in the interests of transparency, industry collaboration and strengthening the resilience of South Africa’s DNS infrastructure.

This document should be read as a historical record of the incident based on the information available when the original report was finalised in May 2025. Subsequent operational developments, additional technical analysis and the implementation of further mitigation measures are summarised in the Post-Incident Update included at the end of this document.

We believe that openly sharing operational experience, lessons learned and continuous improvements contributes to a stronger, more resilient Internet ecosystem. It is in that spirit that this Incident Review is published.