Since yesterday, 7 October around 14:03 UTC, Power BI in the browser stopped loading for everyone on our internal network. Outside the corporate network it works fine, which sent us chasing the firewall and VPN for a while before we found the actual cause: Quad9 is returning NXDOMAIN for app.powerbi.com.
Our DNS servers forward to 9.9.9.9, with Cloudflare as secondary forwarders. Because Quad9 answers with NXDOMAIN rather than timing out, Windows DNS treats it as a valid answer and never tries the next forwarder, so every client in the forest gets "DNS name does not exist". No traffic ever reaches the firewall, which is why nothing showed up in the logs.
Our DNS analytics show normal NOERROR answers for app.powerbi.com up to 7 October 14:03 UTC on every DC, and only NXDOMAIN from that moment on. A DC in a separate forest that uses different forwarders still resolves it normally. Other Power BI names such as api.powerbi.com still resolve; only app.powerbi.com is affected.
Reproduced from an unrelated machine outside our network this morning:
$ dig app.powerbi.com @9.9.9.9 ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN ;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 $ dig app.powerbi.com @149.112.112.112 ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN ;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 $ dig app.powerbi.com @9.9.9.10 (Quad9 unfiltered) ;; ->>HEADER<<- opcode: QUERY, status: NOERROR ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1 $ nslookup app.powerbi.com 1.1.1.1 app.powerbi.com canonical name = app.privatelink.analysis.windows.net. app.privatelink.analysis.windows.net canonical name = pbi-wfe-prod-afd-tm.trafficmanager.net. pbi-wfe-prod-afd-tm.trafficmanager.net canonical name = app-pbi-wfe-france-central-primary-v3...azurewebsites.net. Address: 20.43.41.176 According to Quad9's own docs, NXDOMAIN with AUTHORITY: 0 and no RA flag is their block signature, not a real nonexistent domain. The unfiltered resolver 9.9.9.10, Cloudflare and Google all return the normal CNAME chain, so this looks like a threat feed false positive on the filtered service. The privatelink.analysis.windows.net hop in the chain is standard for every Power BI tenant, not something we configured.
Is anyone else seeing this on Quad9? We are reporting it to Quad9 as a false positive as well.
Source: r/Quad9 · by /u/Sea-Belt6509