Summary

  • In a study presented at RIPE 93, researchers measured seven major NTP services. Microsoft operated 12 time-server addresses, yet more than half of roughly 9,000 RIPE Atlas test locations received a DNS answer with just one address.
  • Four GPS-synchronised observation points later found three Microsoft servers offset for several hours in one measurement, one by around 40–50 milliseconds. The measured offset sat within the paper's example security-protocol tolerances; the single-source default is the larger control question.

Imagine a clock shop with twelve instruments on the wall. You ask which one to trust. The clerk hands you one address and closes the drawer. Microsoft’s time service gave more than half of the study’s test locations that kind of answer, according to the October 2026 original paper presented on the RIPE 93 programme.

The researchers examined Microsoft, Apple, Google, Ubuntu, AWS, Cloudflare and Meta. They found three services using IP anycast and four generally using multiple unicast addresses. The important count, however, sits at the other end of the transaction. An operator can own a dozen time servers while DNS maps a particular client to one. The paper queried from roughly 9,000 RIPE Atlas vantage points. Over half were offered a single Microsoft server address. That is a measurement of answers to probes, a better denominator than an invented count of affected laptops.

Why does one address matter? A client with one source has no second clock against which to test a suspicious reading. RFC 8633 recommends multiple independent sources for robust time service. Microsoft already had twelve server addresses in this study; returning several to a client is a mapping decision. The paper’s authors recommend four. That recommendation asks for a change at the DNS counter, not a new clock factory.

A separate accuracy experiment made the issue less theoretical. From four GPS-synchronised sites, the team sent NTP queries during 24-hour windows between May 2025 and June 2026. In one measurement, three Microsoft servers ran off for hours; one showed about 40–50 milliseconds of offset. The authors say the example security protocols they examined tolerate those offsets. They also explain why a lone source leaves a client poorly placed to detect a more serious error. The result is a test of fault detection, not a claim that a certificate or route already failed.

The same SIDN Labs publication record identifies the expanded paper and its 2026 release. Its standards survey found Cloudflare alone combining IPv6, Network Time Security, RPKI and DNSSEC among the seven services at the measurement window; Ubuntu also supported NTS. RFC 8915 defines that authenticated time mechanism. These details matter because time is a dependency of DNS caches, TLS validation and RPKI objects. A little host name such as time.windows.com can conceal a considerable stack of operating choices.