Is Duo Security Down?

No — Duo Security is up

Reachable from all 8 checked regions

Average response time: 545ms

Last checked 3 hours ago · checks run every 6 hours

Official status page: https://status.duo.com

Duo Security uptime

100%

Last 7 days

100%

Last 30 days

100%

Last 90 days

520ms

Avg response, 30 days

Measured from multiple regions every 6 hours. Percentages count only checks that returned an availability answer — 59 days measured so far. A dash means that window does not yet hold enough measured days to publish a figure.

30-day history

59-day clean streak

Sep 14 Today

No downtime Partial Downtime Not measurable No data

Reachability by region

Each region runs its own request from a different part of the world. A service can be up for one continent and down for another, which is usually the first sign of a routing or CDN problem.

ams

544ms

DNS 152ms TCP 2ms TLS 4ms TTFB 540ms

arn

555ms

DNS 55ms TCP 6ms TLS 10ms TTFB 504ms

cdg

492ms

DNS 33ms TCP 1ms TLS 4ms TTFB 488ms

dfw

494ms

DNS 79ms TCP 1ms TLS 3ms TTFB 346ms

ewr

215ms

DNS 85ms TCP 7ms TLS 9ms TTFB 200ms

fra

554ms

DNS 67ms TCP 1ms TLS 5ms TTFB 550ms

gru

1215ms

DNS 136ms TCP 1ms TLS 4ms TTFB 868ms

yyz

292ms

DNS 159ms TCP 8ms TLS 51ms TTFB 272ms

What Duo Security does

Duo is Cisco's multi-factor authentication and device trust service. It sits in front of VPNs, remote desktops, and web applications, adding a push notification, phone call, or passcode to a password login. Universities, hospitals, and companies route staff access through it, so it is a dependency for signing in rather than an application people open directly.

What an outage looks like

A Duo outage stops the second factor rather than the password step: the login page accepts credentials, then hangs waiting for approval, and the push notification never reaches the phone. Phone-call and SMS passcode delivery can fail separately from push. VPN and remote desktop connections drop out first because they re-authenticate most often.

What to do about it

Find your deployment identifier first. status.duo.com reports each customer deployment separately, numbered DUO1 through DUO81, and your Duo administration URL identifies which one you are on, so a neighbouring deployment being healthy tells you nothing. Hardware tokens and bypass codes issued in advance keep working when push delivery fails, because they generate passcodes offline.

Is it down for everyone, or just you?

If this page says Duo Security is up but it is not loading for you, the problem is between you and them. Run a check against any URL from up to 17 cities across three regions to find out where it breaks.

Test it yourself

Related services

Duo Security outage FAQ

Is Duo down for everyone or just my organisation?

Almost certainly just your deployment. Duo runs many separate customer deployments and status.duo.com reports each one on its own line, so an incident on one leaves the next untouched. Check the deployment number in your Duo administration URL against the status page before assuming the outage is global.

Can I still log in if Duo push notifications are not arriving?

Often yes, through a different factor. Push, phone call, and SMS delivery are listed as separate components and fail independently, so a passcode read from the Duo Mobile app may work when a push does not. Hardware tokens generate their codes offline and are unaffected by delivery problems.

Does a Duo outage lock administrators out too?

It can, which is why bypass codes exist. The Admin Panel is tracked as its own component and can fail while authentication still works, or the reverse. Organisations normally issue a small number of bypass codes or keep a break-glass account that does not require the second factor, specifically for this situation.

Does a Duo outage affect Okta or other single sign-on?

Only where Duo is the second factor behind them. Duo is frequently chained after an identity provider, so a Duo incident blocks logins that would otherwise succeed. Okta and OneLogin run their own platforms with their own status pages, so check each separately rather than assuming one covers the other.

How long do Duo outages usually last?

There is no fixed pattern and Duo does not publish an average. Delivery problems affecting push or SMS can persist longer than core authentication faults, because they depend on carriers and mobile push networks outside Duo's control. The incident note for your own deployment number carries the timeline, updated as engineers post.

How we measure this

We request Duo Security's public endpoint every 6 hours from Fly.io regions across six continents — the most recent check ran from 8 of them.
A region counts as down only when it gets no usable HTTP response. A 403 or 429 means the origin answered and refused us, which we report as blocked, never as an outage.
A single failing region is treated as probe noise. We only change the verdict when two consecutive cycles agree.
Response times average only the regions that actually served the page, so a timeout never inflates the number.
Where Duo Security publishes an official status feed we read it too. An all-clear from the vendor can soften an unconfirmed degradation; a vendor-declared outage only worsens our verdict when our own checks corroborate it.

Get alerted when Duo Security goes down

This page refreshes every 6 hours. Your own monitors run as often as every 30 seconds, from up to 17 cities across three regions, and tell you the moment something breaks.

Start Free Monitoring

Free plan available No credit card required