What Happens If a Tor Directory Authority Goes Offline?

Tor directory authorities are trusted servers responsible for maintaining, verifying, and publishing the official list of active relays across the network. If a single directory authority goes offline, the Tor network continues to function normally with zero disruption for end users and relays due to an integrated majority-consensus mechanism. This article explains the role of directory authorities, how the consensus model handles outages, and what the theoretical limits of this resilience are.

How Tor Directory Authorities Work

The Tor network relies on a semi-centralized group of trusted servers known as directory authorities (dirauths). Currently, there are around nine directory authorities distributed globally, managed by independent, vetted operators.

Every hour, each active directory authority independently tests and measures the status, bandwidth, and security flags of all known relays in the Tor network. The authorities then communicate with one another to vote on the state of the network, combining their individual views into a single, cryptographically signed document known as the “consensus.”

The Impact of a Single Authority Going Offline

When one directory authority goes offline, the following occurs:

• Consensus Creation Continues: The consensus process requires a simple majority (more than 50%) of directory authorities to agree on the network state. If one of nine authorities goes down, the remaining eight still easily constitute a valid voting quorum.
• No Client Interruption: Tor clients (such as the Tor Browser) download the hourly consensus from regular directory cache relays, not directly from the authorities. Because the consensus is still signed by a majority of authorities, clients accept it without error.
• Relay Operation Remains Stable: Relays continue routing traffic as usual. They upload their updated descriptors to the remaining online authorities.

What Happens If Multiple Authorities Go Offline?

The Tor network’s fault tolerance depends strictly on maintaining a voting quorum:

• Minority Outage (Up to 4 of 9 offline): The network functions normally. The remaining authorities still form a majority, calculate the consensus, sign the document, and publish updates.
• Majority Outage (5 or more of 9 offline): The authorities cannot reach the required voting threshold to generate a new signed consensus. In this scenario, the network enters a degraded state:
  • Clients and relays continue to use the last known valid consensus until it expires (typically after a few hours).
  • No new relays can join the network, and offline relays cannot be removed from routing tables.
  • Once the existing consensus fully expires, new circuits fail to build, significantly disrupting Tor network connectivity.

Long-Term Management of Offline Authorities

Directory authorities occasionally experience scheduled maintenance, technical failure, or retirement. If an authority goes offline temporarily, it simply rejoins the voting cycle once restored. If an authority is permanently decommissioned or compromised, the Tor development team releases a new version of the Tor software that updates the hardcoded list of trusted directory authority IP addresses and cryptographic keys across all clients and relays.