Is Duo Security Down?

No — Duo Security is up

Reachable from all 8 checked regions

Average response time: 371ms

Last checked 4 hours ago · checks run every 6 hours

Official status page: https://status.duo.com

Duo Security uptime

100%

Last 7 days

100%

Last 30 days

100%

Last 90 days

432ms

Avg response, 30 days

Measured from multiple regions every 6 hours. Percentages count only checks that returned an availability answer — 8 days measured so far. A dash means that window does not yet hold enough measured days to publish a figure.

30-day history

8-day clean streak

Jul 25 Today

No downtime Partial Downtime Not measurable No data

Reachability by region

Each region runs its own request from a different part of the world. A service can be up for one continent and down for another, which is usually the first sign of a routing or CDN problem.

ams

468ms

DNS 1ms TCP 1ms TLS 208ms TTFB 464ms

arn

547ms

DNS 0ms TCP 3ms TLS 8ms TTFB 539ms

bom

503ms

DNS 0ms TCP 2ms TLS 5ms TTFB 267ms

nrt

366ms

DNS 0ms TCP 2ms TLS 6ms TTFB 362ms

ord

217ms

DNS 0ms TCP 2ms TLS 4ms TTFB 212ms

sin

582ms

DNS 0ms TCP 1ms TLS 3ms TTFB 575ms

sjc

37ms

DNS 0ms TCP 3ms TLS 5ms TTFB 30ms

syd

455ms

DNS 0ms TCP 1ms TLS 6ms TTFB 445ms

yyz

160ms

DNS 0ms TCP 8ms TLS 10ms TTFB 141ms

What Duo Security does

Duo is Cisco's multi-factor authentication and device trust service. It sits in front of VPNs, remote desktops, and web applications, adding a push notification, phone call, or passcode to a password login. Universities, hospitals, and companies route staff access through it, so it is a dependency for signing in rather than an application people open directly.

What an outage looks like

A Duo outage stops the second factor rather than the password step: the login page accepts credentials, then hangs waiting for approval, and the push notification never reaches the phone. Phone-call and SMS passcode delivery can fail separately from push. VPN and remote desktop connections drop out first because they re-authenticate most often.

What to do about it

Find your deployment identifier first. status.duo.com reports each customer deployment separately, numbered DUO1 through DUO81, and your Duo administration URL identifies which one you are on, so a neighbouring deployment being healthy tells you nothing. Hardware tokens and bypass codes issued in advance keep working when push delivery fails, because they generate passcodes offline.

Is it down for everyone, or just you?

If this page says Duo Security is up but it is not loading for you, the problem is between you and them. Run a check against any URL from all 18 regions to find out where it breaks.

Test it yourself

Related services

Duo Security outage FAQ

Is Duo down for everyone or just my organisation?

Almost certainly just your deployment. Duo runs many separate customer deployments and status.duo.com reports each one on its own line, so an incident on one leaves the next untouched. Check the deployment number in your Duo administration URL against the status page before assuming the outage is global.

Can I still log in if Duo push notifications are not arriving?

Often yes, through a different factor. Push, phone call, and SMS delivery are listed as separate components and fail independently, so a passcode read from the Duo Mobile app may work when a push does not. Hardware tokens generate their codes offline and are unaffected by delivery problems.

Does a Duo outage lock administrators out too?

It can, which is why bypass codes exist. The Admin Panel is tracked as its own component and can fail while authentication still works, or the reverse. Organisations normally issue a small number of bypass codes or keep a break-glass account that does not require the second factor, specifically for this situation.

Does a Duo outage affect Okta or other single sign-on?

Only where Duo is the second factor behind them. Duo is frequently chained after an identity provider, so a Duo incident blocks logins that would otherwise succeed. Okta and OneLogin run their own platforms with their own status pages, so check each separately rather than assuming one covers the other.

How long do Duo outages usually last?

There is no fixed pattern and Duo does not publish an average. Delivery problems affecting push or SMS can persist longer than core authentication faults, because they depend on carriers and mobile push networks outside Duo's control. The incident note for your own deployment number carries the timeline, updated as engineers post.

How we measure this

We request Duo Security's public endpoint every 6 hours from Fly.io regions across six continents — 8 of them answered the most recent check.
A region counts as down only when it gets no usable HTTP response. A 403 or 429 means the origin answered and refused us, which we report as blocked, never as an outage.
A single failing region is treated as probe noise. We only change the verdict when two consecutive cycles agree.
Response times average only the regions that actually served the page, so a timeout never inflates the number.
Where Duo Security publishes an official status feed we read it too. An all-clear from the vendor can soften an unconfirmed degradation; a vendor-declared outage only worsens our verdict when our own checks corroborate it.

Get alerted when Duo Security goes down

This page refreshes every 6 hours. Your own monitors run as often as every 30 seconds, from the same 18 regions, and tell you the moment something breaks.

Start Free Monitoring

Free plan available No credit card required