CO.ZA under attack

South Africa’s country code top-level domain (ccTLD), .ZA, is facing a denial of service attack, ZA Registry Consortium executive for registry operations Jerry Maleka has told MyBroadband.

MyBroadband was contacted by several Internet and hosting providers on Thursday who said they were seeing errors when trying to resolve CO.ZA domains.

This was after several PretoriaFM listeners in Europe reported on Saturday that they were struggling to access the radio station’s online live stream.

People in Poland, Switzerland, Germany, and the United States reported intermittent problems getting to South African websites using CO.ZA domains.

At our request, the users tested sites like Takealot.com (working), MTN.co.za (error), MTN.com (working), Vodacom.co.za (error), and Vodacom.com (working).

While the problems on Saturday appeared to resolve on their own, they cropped up again on Thursday.

Downdetector showed a spike in outage reports, including at OpenDNS and Google Public DNS.

However, an industry source said that the problem affected many domain name system (DNS) servers, not just those hosted by OpenDNS and Google.

DNS is a critical Internet protocol that translates Internet domains like mybroadband.co.za into the numbers that routers and servers can understand. It can be thought of as the phone book of the Internet.

Another industry source told MyBroadband that two of the DNS servers powering the .ZA namespace had stopped responding on Thursday.

As a result, caching servers like Google’s were returning DNS resolution errors.

“It caused mayhem,” they said.

The problems began earlier in the afternoon on Thursday, and once again appeared to resolve themselves an hour or two later.

Denial of Service Attack

South Africa’s ccTLD infrastructure is managed by an organisation called the ZA Registry Consortium (ZARC). Currently only certain second-level TLDs are supported, like co.za, net.za, org.za, and web.za.

ZARC is a joint venture with DNS Business — not to be confused with the DNS protocol — which handles the technical infrastructure of the .ZA zone.

ZARC’s registry operations executive, Jerry Maleka, confirmed that they had been experiencing problems since 6 March 2025.

“Currently our teams are investigating, but it seems like we’re having a denial of service attack,” he said.

A denial of service attack is typically where a flood of network traffic is directed at a server to overwhelm it, preventing it from responding to legitimate traffic.

Maleka said they are trying to isolate the attack and will provide further feedback as soon as possible.