[as112-ops] hidden secondary for iana.org?

[Aleksi Suhonen]

I wrote:
 >> I see queries for prisoner.iana.org and blackhole-#.iana.org quite
 >> often on our AS112 server

Joe Abley wrote:
> That's interesting. Do you have any idea why?
 > are there clients which normally send queries for IANA.ORG to the
 > AS112 servers, just for fun?

Yes, I suspect this is so. I also see a lot of other queries that have 
nothing to do with in-addr.arpa. on the surface.

> Is your AS112 server doing dual-duty as some other kind of server?

No, it's purely standalone. I did think about using it as a secondary 
resolver for a few other boxes, but quickly dismissed the idea because 
of the security issues involved.

>> Apart from IANA's willingness to share access to such hidden 
>> secondaries of course.

> ... I'm not sure what benefit slaving IANA.ORG would really have for 
> anybody, over the normal referral path to the IANA.ORG authoritative 
> servers.

Well if you want to argue for the futility, then the whole AS112 prefix 
could just as well be black-holed, since what the servers mostly do is 
send negative answers to addresses whose reverse path doesn't exist.
I was just trying to be a bit more constructive. :-)

--
	Aleksi Suhonen / TREX