enum.co not resolving

Summary

On October 20, 2026, from 10:50 to 11:09 UTC, enum.co did not resolve. For about 18 minutes, anyone whose resolver did not have the records cached could not reach our website, the console, the API at api.enum.co or our identity provider at id.enum.co. Mail to @enum.co addresses was delayed.

This was our mistake. enum.co runs on the same nameservers as customer zones, but it was managed with legacy internal tooling from before enum DNS existed, and we never moved it onto the platform. That left it outside the safeguards that protect customer zones. A security researcher testing enum DNS triggered a cleanup that removed it, and reported it to us minutes later, while our on-call engineers were already debugging.

Impact

• enum.co and every subdomain returned no answers, so the console and the API were unavailable, including for managing DNS zones.
• Customer DNS zones kept resolving the whole time. No other zone on our nameservers was changed or removed.
• No customer data was accessed or exposed.

You do not need to do anything.

Timeline

All times are UTC on October 20, 2026.

• 10:50 An enumd platform resource finalizer removes the enum.co zone from our nameservers.
• 10:52 Our external DNS probe alerts the on-call engineers.
• 10:59 We identify the cause: the enum.co zone was removed from our nameservers. We start restoring it from backup.
• 11:07 We stop the DNS platform from changing enum.co while we copy it back.
• 11:09 enum.co and its records are back. All nameservers answer correctly.

What went wrong

The platform removes a zone from our nameservers once nobody claims it anymore. Because of legacy internal tooling, enum.co existed only on the nameservers and was never registered on the platform, so it could be treated as unclaimed.

Customer domains were never at risk. Every customer zone is created through the platform and has an owner, so this could only happen to a zone that existed outside it.

Thanks

Muhammad Zeeshan stopped testing as soon as the impact was visible, reported it to us minutes later, while our on-call engineers were already debugging, and described every step precisely enough to match our logs to the second. We are rewarding the report under our responsible disclosure policy.

If you find something in enum, write to security@enum.co. We confirm receipt within 48 hours.