winget upgrade fails for "aka.ms" sites reachability problems

[mgua]

Relevant area(s)

WinGet CLI

Relevant command(s)

No response

Brief description of your issue

I am having problems in downloading updates where the external repos are on https://aka.ms/* sites.
this is apparently a distribued issue impacting several countries. Using a vpn client from another location usually helps.

Steps to reproduce

here is an example, generated with "winget upgrade Microsoft.AppInstaller"

The issue is impacting other microsoft products installers too, like ms visual studio installer

I interacted with microsoft help desk, who provided me an updated certificate to be installed on my machine,
[https://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Code%20Signing%20PCA%202024.crt]
but this did not help.

Expected behavior

the download to happen and installation to complete

Actual behavior

https://aka.ms/* repos appear unreachable

Environment

~#@❯ winget --info
Windows Package Manager v1.12.350
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.22631.6199
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.27.350.0

Winget Directories
-----------------------------------------------------------------------------------------------------------------------
Logs                               %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\Diag…
User Settings                      %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\sett…
Portable Links Directory (User)    %LOCALAPPDATA%\Microsoft\WinGet\Links
Portable Links Directory (Machine) C:\Program Files\WinGet\Links
Portable Package Root (User)       %LOCALAPPDATA%\Microsoft\WinGet\Packages
Portable Package Root              C:\Program Files\WinGet\Packages
Portable Package Root (x86)        C:\Program Files (x86)\WinGet\Packages
Installer Downloads                %USERPROFILE%\Downloads
Configuration Modules              %LOCALAPPDATA%\Microsoft\WinGet\Configuration\Modules

Links
---------------------------------------------------------------------------
Privacy Statement   https://aka.ms/winget-privacy
License Agreement   https://aka.ms/winget-license
Third Party Notices https://aka.ms/winget-3rdPartyNotice
Homepage            https://aka.ms/winget
Windows Store Terms https://www.microsoft.com/en-us/storedocs/terms-of-sale

Admin Setting                             State
--------------------------------------------------
LocalManifestFiles                        Disabled
BypassCertificatePinningForMicrosoftStore Disabled
InstallerHashOverride                     Disabled
LocalArchiveMalwareScanOverride           Disabled
ProxyCommandLineOptions                   Disabled
DefaultProxy                              Disabled

[mgua]

here is some more support information. apparently aka.ms is not resolved from my location (italy).

 ~#@❯ wget  https://aka.ms/windowsappsdk/1.8/1.8.251106002/windowsappruntimeinstall-x64.exe
--2026-01-09 09:18:41--  https://aka.ms/windowsappsdk/1.8/1.8.251106002/windowsappruntimeinstall-x64.exe
Resolving aka.ms (aka.ms)... failed: No such host is known. .
wget: unable to resolve host address 'aka.ms'
 ~#@❯ ping aka.ms
Ping request could not find host aka.ms. Please check the name and try again.
 ~#@❯ ping google.com

Pinging google.com [216.58.204.238] with 32 bytes of data:
Reply from 216.58.204.238: bytes=32 time=13ms TTL=113

Ping statistics for 216.58.204.238:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 13ms, Maximum = 13ms, Average = 13ms

[denelon]

@mgua thanks for sharing the network related details. I'll see if I can find some information about the availability of the aka.ms domain. I'm hoping it's just a transient issue.

[mgua]

I discovered that Microsoft has a specific tool to check their cloud resources availability from any specific user location.

This tool is available at [https://connectivity.m365.cloud.microsoft/]

I launched the tool over 1h ago, from our quite fast company network connection, and it seems stuck.

[denelon]

What region of the world/country are you in?

[denelon]

I submitted an internal ticket referencing Italy.

[denelon]

The team took a look, and it doesn't appear to be a regional issue. Could you try with a different nameserver?

[denelon]

I used a web-based redirect checker.

The final URL for the installer is: https://download.microsoft.com/download/3e79c3ea-6c2f-4cb4-ac61-462a8d73eb4a/WindowsAppRuntimeInstall-x64.exe

[mgua]

Problem still open this morning. aka.ms not resolved from our location (tried with our carrier DNS, 1.1.1.1, 8.8.4.4). microsoft.com and other domain queries do work.

I wonder if this anomaly could be related to cloudflare.

evidence follows:

 ~#@❯ winget upgrade Microsoft.AppInstaller
Found App Installer [Microsoft.AppInstaller] Version 1.27.440.0
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
This package requires the following dependencies:
  - Packages
      Microsoft.VCLibs.Desktop.14 [>= 14.0.33728.0]
      Microsoft.VCLibs.14 [>= 14.0.33519.0]
      Microsoft.WindowsAppRuntime.1.8 [>= 1.8.0]
(1/2) Found Microsoft Visual C++ 2015 UWP Runtime Package [Microsoft.VCLibs.14] Version 14.0.33519.0
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
Successfully verified installer hash
Extracting archive...
Successfully extracted archive
Starting package install...
  ██████████████████████████████  100%
Successfully installed

(2/2) Found Windows App Runtime 1.8 [Microsoft.WindowsAppRuntime.1.8] Version 1.8.3
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
Downloading https://aka.ms/windowsappsdk/1.8/1.8.251106002/windowsappruntimeinstall-x64.exe
An unexpected error occurred while executing the command:
InternetOpenUrl() failed.
0x80072ee7 : unknown error

 ~#nslookup
Default Server:  <intranet server redacted>
Address:  <redacted>

> aka.ms
Server:  <intranet server redacted>
Address:  <redacted>

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to <intranet server redacted> timed-out
> orange.fr
Server:  <intranet server redacted>
Address:  <redacted>

Non-authoritative answer:
Name:    orange.fr
Addresses:  193.252.117.135
          81.52.142.219
          193.252.148.46

> server 1.1.1.1
Default Server:  one.one.one.one
Address:  1.1.1.1

> aka.ms
Server:  one.one.one.one
Address:  1.1.1.1

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to one.one.one.one timed-out
> google.com
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
Name:    google.com
Addresses:  2a00:1450:4002:400::200e
          216.58.204.142

> server 8.8.4.4
Default Server:  dns.google
Address:  8.8.4.4

> aka.ms
Server:  dns.google
Address:  8.8.4.4

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to dns.google timed-out
> microsoft.com
Server:  dns.google
Address:  8.8.4.4

Non-authoritative answer:
Name:    microsoft.com
Addresses:  2603:1030:c02:8::14
          2603:1020:201:10::10f
          2603:1010:3:3::5b
          2603:1030:b:3::152
          2603:1030:20e:3::23c
          13.107.246.60
          13.107.213.60

>