<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Times New Roman; font-size: 12pt; color: #000000'><span>Hi,<br><br>I've a logging the named querys on one of public resolver server (ISP) , but after researching we detect some querys that are logged as generated seems itlsef as '127.0.0.1' address, in some of cases the query points to a hostname that resolves also as '127.0.0.1', for example:<br><br><br>28-Sep-2015 09:09:21.528 client 127.0.0.1#28082: <font color="#3333FF">query: f5-hk01.gtm.lenovo.com IN A -E</font><br><br>Non-authoritative answer:<br>Name: f5-hk01.gtm.lenovo.com<br>Address: 127.0.0.1<br><br><span name="x"></span></span>Not always the querys points to resolv host with result '127.0.0.1' , but the strange is the origen marked as localhost came from, and always logs using "EDNS mechanism" ( -E ), previously came from a regular query, for example<br><br><br>05-Sep-2015 01:32:20.756 client some-ip-public-client.(1.2.3.4)#53347: query: news.lawsorsing.com IN A +<br>05-Sep-2015 01:32:20.766 client some-ip-public-client.(1.2.3.4)#34024: query: news.lawsorsing.com IN A +<br><br>and few seconds later, the "local query" are generated:<br><br>05-Sep-2015 01:32:21.160 client 127.0.0.1#25468: query: news.lawsorsing.com IN A -E<br>05-Sep-2015 01:32:21.161 client 127.0.0.1#2345: query: news.lawsorsing.com IN A -E<br><br>Someone could explain this please, because the last lines "alone" could made a false positive that the server maybe compromise because are generating query itself. I've suppose that EDNS mechanism could be the cause.<br><br>The situation is very common with '*.gtm.lenovo.com' GTM sites .<br><br><br>Regards<br>Eduardo.<br><br></div></body></html>