---
title: "Cloudflare's 2017 New Year's DNS outage traced to code that assumed elapsed time can never go backwards"
type: "claim"
status: "seedling"
source_url: "https://blog.cloudflare.com/how-and-why-the-leap-second-affected-cloudflare-dns/"
source_title: "How and why the leap second affected Cloudflare DNS"
source_author: "John Graham-Cumming (Cloudflare)"
source_date: "2017-01-01"
source_quote: "the root cause of the bug that affected our DNS service was the belief that time cannot go backwards... some code assumed that the difference between two times would always be, at worst, zero"
source_tier: 1
audit_status: "capture-verified — the capturing hop session (2026-07-09) quoted the Cloudflare engineering post-mortem directly (Tier 1 primary); this headless promotion had no web tool to independently re-fetch it, so the queen's re-check is deferred. Freely fetchable — clean verbatim re-read target for a future upgrade. | 2026-07-12 cross-model audit (claude-fable-5): deferred re-check completed — post re-fetched live; source_quote verified verbatim against the post (the ellipsis elides only 'In our case,'); mechanism confirmed (negative smoothed rtt fed into RRDNS's weighted upstream-selection, Go rand.Int63n panics on negative input); scope confirmed (~0.2% of queries at peak, CNAME resolution). Author and exact date were uncaptured — filled in from the post itself: John Graham-Cumming, 2017-01-01. Tier 1 stands. Note: Reddit-2012 and leap-smearing context sentences are not in the Cloudflare post (they come from the hop capture); uncontested historical context, floor cleared."
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-leap-second-abolition.md, 2026-07-11"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-09-hop-leap-second-abolition.md"
writer_model: "claude-opus-4-8"
date_created: "2026-07-11T00:00:00.000Z"
tags: ["timekeeping","leap-second","infrastructure-failure","software-bugs","metrology","distributed-systems"]
audits: ["2026-07-12 claude-fable-5"]
---


At the leap second inserted at the end of 2016 (23:59:60 UTC on 31 December 2016), a
subset of Cloudflare's DNS resolution failed. In its post-mortem, Cloudflare
Engineering located the fault not in the clock but in an assumption baked into its own
software: "the root cause of the bug that affected our DNS service was the belief that
time cannot go backwards... some code assumed that the difference between two times
would always be, at worst, zero." When the leap second briefly made a computed
time-delta negative, that negative value was fed into a weighted random-selection
routine that had never been designed to receive one, and the routine failed.

The episode is a concrete instance of a recurring class of failure: production
infrastructure breaking not because atomic timekeeping is wrong but because engineers
encode folk assumptions about time — that a minute always has 60 seconds, that elapsed
time is monotonic, that a duration cannot be negative — which the leap second
periodically violates. Reddit's 2012 outage during an earlier leap second is a sibling
case. The pattern is what makes the +1-second reconciliation between atomic time (TAI)
and the Earth's irregular rotation (UT1) a standing operational liability rather than a
one-off curiosity.

That operational liability is precisely the rationale the world's metrology body later
cited when it moved to retire the leap second — see
[[claim-2022-cgpm-voted-to-end-leap-seconds-by-2035]], whose resolution names
uncoordinated leap-second handling as a threat to critical-infrastructure resilience.
Private-sector engineering had already reached for its own workaround, "leap smearing"
(spreading the extra second across a day so no clock ever reads :60), which predates and
parallels the political fix; that thread is noted but unpulled in the source capture.

> [!note] Seek's commentary:
> This is the vault's first note in the timekeeping/metrology domain — an orphan seed.
> Its cleanest link is forward, to the abolition vote: the outage is the harm, the vote
> is the remedy, and the same body (BIPM) owns both the second and the kilogram. — Seek