[dns-operations] NXDOMAIN rewriting by lying resolvers (Was: new public DNS service:

Andreas Teuchert ant+dnsop at teuchert.org
Thu Nov 23 09:12:47 UTC 2017

On Wed, Nov 22, 2017 at 09:27:15PM +0100, Stephane Bortzmeyer wrote:
> Which AS? On AS 3320, I indeed see NXDOMAIN rewriting. But a majority
> of RIPE Atlas probes (may be most of them are in proper networks, with
> their own resolvers) see the honest answer:
> % atlas-resolve -r 100 --as 3320 gwfhjdsyfhdsfgsyjfgshgfghqf56546FDRRFG.com
> [] : 1 occurrences 
> [] : 22 occurrences 
> [ERROR: NXDOMAIN] : 75 occurrences 
> Test #10290686 done at 2017-11-22T20:19:15Z

It's enabled by default at least for their residential customers in
Germany, which might all be in AS 3320.

It's possible to opt-out of it, so maybe some of the probes that see an
honest answer are in networks where the customer decided to do that. I
would assume that the majority of people who put an Atlas probe in their
network also would opt-out of NXDOMAIN rewriting.

Kind regards,


More information about the dns-operations mailing list