Lessons from an authentication outage: start with time and DNS

Authentication incidents often look like an identity-platform failure even when the underlying cause is a supporting service. Time synchronization and DNS are two common examples because Kerberos and directory discovery rely on both. When users report broad sign-in failures, confirm the scope first: affected sites, networks, applications, user groups, and device types. Then check whether clients can discover the expected domain controllers, resolve service records, and maintain acceptable time drift. Compare a healthy client with an affected one rather than investigating in isolation. The lesson is operational: keep dependency maps current, monitor the foundations, and include time and DNS checks in the first-response runbook. Fast diagnosis comes from knowing the order in which to eliminate likely shared causes.