Loading post…
Supabasesara_readIncident / postmortem
Navigating Regional Network Blocks
Summary
Supabase describes how regional network blocks disrupted access to its multi-tenant developer platform and shares three incidents from September 2025 through March 2026. It explains that DNS-level or transport-layer blocking can affect every tenant when projects share domains and IP addresses, while adding a hosting domain to the Public Suffix List provides only partial mitigation. In the UAE, a project distributing unauthorized streaming content triggered an approximately 18-day block that ended after removal and engagement with the TDRA. Yemen saw TCP connections dropped for about eight days with no official explanation, while India’s roughly eight-day restriction was rescinded after project enforcement and technical engagement with MeitY. The post says providers should build regulator contacts, strengthen abuse response pipelines, and develop alternatives such as proxy domains, custom domains, and other workarounds.
Context
Supabase encountered three regional access blocks affecting users on local ISPs. In each case, authorities or an ISP blocked Supabase domains or connections after activity associated with a single hosted project, including unauthorized streaming content or other third-party misuse. The shared domain and IP infrastructure of a multi-tenant platform meant unrelated projects were affected. Existing relationships with relevant authorities were lacking, and Cloudflare could not intervene in government-directed blocking.
Approach / What changed
Supabase added its hosting domain to the Public Suffix List as a partial mitigation, removed or disabled offending projects, and engaged directly with regulators and ISPs. During incidents it used or recommended proxy domains, VPNs, alternative DNS providers, and custom domains where technically feasible. It proposes proactive regulator communication, clearer abuse-response notifications, and expanded alternative-domain infrastructure.
Takeaways
DNS-level blocking interferes with domain lookups, while transport-layer blocking drops TCP connections; both can affect unrelated tenants sharing a platform’s domain or IP addresses.
A UAE proxy domain restored PostgREST, Realtime, and Edge Functions, but auth callbacks and storage object URLs remained affected because of hardcoded domain references.
Customer involvement was decisive: customers helped establish UAE regulator contact, supplied diagnostic assistance in Yemen, and secured restoration by visiting a YemenNet service center.
Source and freshness
- Source
- supabase.com
- Published
- Added to Yomu
- Last updated
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.