Despite having an established framework for official timekeeping, the Dominican Republic faces challenges in providing reliable Network Time Protocol (NTP) services. NTP is a critical system for synchronizing time across various internet-connected applications, including financial transactions and authentication mechanisms.
The Dominican telecommunications regulator, INDOTEL, issued Resolution No. 026-06, which outlines the rules for determining and distributing official time in electronic media. The resolution mandates that regulated entities, such as internet service providers and public organizations, synchronize their systems with an official reference time signal via NTP.
Recently, the Dominican Institute for Quality, INDOCAL, has formalized a national time and frequency standard, which relies on a rubidium atomic clock traceable to Coordinated Universal Time (UTC). Users are instructed to use the server horadominicana.indocal.gob.do for NTP synchronization. However, tests conducted recently found that this hostname could not be resolved, raising concerns about the country’s official NTP service availability.
Efforts to identify public NTP servers in the Dominican Republic yielded no results for the country’s designated time zone. An analysis of 1,475 announced IPv4 prefixes across 190 Dominican Autonomous Systems (ASNs) discovered at least 225 public IP addresses responding to NTP requests. This analysis confirmed that approximately 15.3% of the examined prefixes contained at least one observable NTP responder, with responses appearing in about 38.4% of the ASNs.
Among the responding addresses, various ASNs contributed to the total count, with Altice Dominicana being the largest provider. However, these three leading networks collectively accounted for only a third of the responses, indicating that the presence of NTP responders is not limited to any single provider.
The dataset also suggests that many of the responding devices might not function as public NTP servers. A significant portion of the responders utilized addresses typical for network equipment rather than dedicated time servers. Furthermore, only a small percentage reported Stratum 1, while many returned Stratum 0 or indicated initial synchronization states, reinforcing the idea that these devices may be routers or gateways rather than intentionally public time servers.
Security implications also arise from this situation. While responding to NTP queries does not inherently expose devices to amplification attacks, the unnecessary public exposure of these network devices could increase vulnerability. Best practice recommendations urge that public-facing NTP servers limit control-message queries from outside their networks and suggest filtering NTP queries to trusted sources.
This analysis of the Dominican Republic’s NTP exposure sheds light on a fragmented time synchronization environment, where official time signals are not readily available, and many of the exposed devices may not be appropriately configured for public use. The lack of a clear and reliable national NTP service raises ongoing concerns about time synchronization across critical internet operations in the country.
