Outlook, 2026-11-12: the DNS readings

• Step 1, DNS: at 21:36Z the Outlook names resolved, with ad set, at every resolver asked. Over the night, two asks of 1.1.1.1 from South Carolina found no addresses.
• They all end at one name. Its answer is 8 addresses or fewer and changes from ask to ask and by client subnet.
• Step 2, HTTP, 21:49Z to 07:06Z: the two US probes tried the addresses they were handed 1682 times and 24 answered 302. Amsterdam tried 834 times and 177 answered 302.
• Step 2, HTTP, 11:35Z to 12:39Z: the US probes tried 202 times and 148 answered 302. Amsterdam tried 112 times and 69 answered 302.

Each city does two steps: 1 DNS finds Outlook's addresses, 2 HTTP asks each address for the page. One cell per 10 minutes, 2026-11-12 21:40Z to 2026-11-13 12:39Z, the hour marked above its first cell. No sampler ran from 07:10Z to 11:35Z.

        21    22    23    00    01
Phoenix
1 DNS   ....##########################
2 HTTP  ....-+------------------------
South Carolina
1 DNS   ....##########++##############
2 HTTP  ....------------------------++
Amsterdam
1 DNS   .....#########################
2 HTTP  .....+++++++++++++++++++++++++

        02    03    04    05    06
Phoenix
1 DNS   ##############################
2 HTTP  -------+++--++-------+-++-++-+
South Carolina
1 DNS   ##############################
2 HTTP  ----------------+--++--++-+---
Amsterdam
1 DNS   ##############################
2 HTTP  +++++++++++-+-++++++-+++-++-++

        07    08    09    10    11
Phoenix
1 DNS   #..........................###
2 HTTP  -..........................+++
South Carolina
1 DNS   #..........................###
2 HTTP  -..........................-++
Amsterdam
1 DNS   #..........................###
2 HTTP  +..........................+++

        12
Phoenix
1 DNS   ####
2 HTTP  +++#
South Carolina
1 DNS   ####
2 HTTP  +++#
Amsterdam
1 DNS   ####
2 HTTP  ++++

1 DNS   # found the addresses
        + some asks did
        - found none
2 HTTP  # every address answered
        + some did
        - none did
.       no reading, or no address to try

What each try at step 2 did, 2026-11-12 21:49Z to 2026-11-13 07:06Z:

And 2026-11-13 11:35Z to 12:39Z:

Each probe asks 1.1.1.1 for the address set, then requests /owa/ once at each address it was handed, with 5 seconds to connect and finish TLS and 8 in all. In the timeline an address answered when it sent 302, the reply /owa/ gets from a front door that is serving. Of the 527 tries that connected and got no HTTP answer, 35 had finished TLS. No US try answered 302 between 21:53Z and 01:39Z. Two South Carolina asks (23:28Z, 23:33Z) returned no addresses. Not an isitdns reading: a sampler on the probe seats. It did not run from 07:10Z to 11:35Z, and this cut ends at 12:39Z.

One example of each, curl -m 8 --connect-timeout 5 --resolve outlook.office365.com:443:<address> https://outlook.office365.com/owa/:

• 302: Amsterdam, 40.101.69.34, 00:38:04. TCP at 0.024 s, TLS at 0.114 s, HTTP/2 302, location: https://outlook.office365.com/mail/
• 500: South Carolina, 40.99.165.114, 00:27:53. TCP at 4.18 s, TLS at 4.49 s, HTTP 500
• TCP, no HTTP answer: Phoenix, 52.96.164.178, 00:37:18. Connected at 4.127 s, client hello sent, SSL connection timeout at 5.0 s
• no TCP: Phoenix, 52.96.163.34, 00:37:23. connect to 52.96.163.34 port 443 failed: Connection timed out at 5.0 s

An address moves between outcomes: 40.99.165.114 read 500 at 00:27Z and no HTTP answer at 00:37Z.

Ask the name live, four resolvers side by side.

What each region is handed#

Google passes a client subnet to the zone when asked to (RFC 7871). The same question with five subnets, 21:40:18Z:

Asked again at 21:42:20Z, the five read 1, 8, 8, 5 and 2. Of the five subnets, only 81.2.69.0/24 kept its count.

What connects#

curl --resolve outlook.office365.com:443:<address> from the probe seats, /owa/, 21:37Z. Not an isitdns reading.

The path to a silent address, 52.96.163.34, enters Microsoft's network (AS8075) from both Phoenix and Amsterdam and the last hop that answered was in 104.44.52.0/24 (AS8075) from both: hop 11 from Phoenix, hop 17 from Amsterdam. The path to 40.101.69.34 answers end to end from both. Not an isitdns reading: mtr -T -P 443 from the probe seats, 2026-11-13 00:40Z.

What resolves#

Cloudflare, Google, Quad9 and AdGuard from the edge (DoH), and 1.1.1.1 from Phoenix and Amsterdam (Do53), 21:36Z. outlook.office365.com and outlook.office.com are CNAMEs to outlook.cloud.microsoft, which is a CNAME to fs.outlook.mira.tm.svc.cloud.microsoft: an A set with a 10 second TTL. The delegation and the DNSSEC chain read with no break.

$ dig -4 @1.1.1.1 fs.outlook.mira.tm.svc.cloud.microsoft A

From the Amsterdam probe, 21:40:06Z. The addresses, the TTL, the id and the Query time change from run to run.

Not measured#

• These names before 19:00Z, so the changing answer size has no reading from a normal day.
• IPv6 connections, sign-in, and mail flow.
• Your own resolver and your own path: test your own path.
• Why Microsoft's service failed. Microsoft's EX1550543 had no published cause at the time of these readings (CU Boulder OIT, TechRadar).

Ask again#

See also#

• Connection timed out
• How isitdns measures