<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
<style>
div.plaintext { white-space: normal; }
body { font-family: sans-serif; }
div.plaintext h1 { font-size: 1.4em; }
div.plaintext h2 { font-size: 1.2em; }
div.plaintext h3 { font-size: 1.1em; }
blockquote.embedded,div.plaintext blockquote { margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #777777; color: #777777; }
blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote { border-left-color: #999999; color: #999999; }
blockquote.embedded blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote blockquote { border-left-color: #BBBBBB; color: #BBBBBB; }
blockquote.embedded,div.plaintext blockquote a { color: #777777; }
blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote a { color: #999999; }
blockquote.embedded blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote blockquote a { color: #BBBBBB; }
div.plaintext math[display="inline"] > mrow { padding:5px; }
div.plaintext div.footnotes li p { margin: 0.2em 0; }
</style>
</head>
<body>
<div class="plaintext"><p dir="auto">I believe it is safe to assume that documentation might be outdated or inaccurate. <br>
I’ve been probing this for a while using RIPE Atlas network around the world and sending queries like this:</p>
<p dir="auto">dig +short TXT maxmind.test-ipv6.com @8.8.8.8</p>
<p dir="auto">It returns the IP address AS number from which the resolver sends a query (should be one of those IP addresses Google published). There has been several cases that IPs belonged the Google (AS15169) but was not in the list you mentioned. And it turned out there are operators around the world who redirect DNS traffic toward their own resolvers (like 2% of responses were coming from IP addresses did not belong to Google).</p>
<p dir="auto">Kind Regards,</p>
<p dir="auto">-- <br>
Babak Farrokhi</p>
<br><p dir="auto">On 19 Oct 2017, at 20:13, Andrea Barberio wrote:</p>
</div>
<blockquote class="embedded"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><style></style><style>
div.plaintext { white-space: normal; }
body { font-family: sans-serif; }
div.plaintext h1 { font-size: 1.4em; }
div.plaintext h2 { font-size: 1.2em; }
div.plaintext h3 { font-size: 1.1em; }
blockquote.embedded,div.plaintext blockquote { margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #777777; color: #777777; }
blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote { border-left-color: #999999; color: #999999; }
blockquote.embedded blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote blockquote { border-left-color: #BBBBBB; color: #BBBBBB; }
div.plaintext a { color: #3983C4 }
blockquote.embedded,div.plaintext blockquote a { color: #777777; }
blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote a { color: #999999; }
blockquote.embedded blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote blockquote a { color: #BBBBBB; }
div.plaintext math[display="inline"] > mrow { padding:5px; }
div.plaintext div.footnotes li p { margin: 0.2em 0; }
</style></div><div>Maybe silly, but you could do some enumeration test with scapy and whoami from multiple vantage points to build your list, and cross the results with the subnets declared at https://developers.google.com/speed/public-dns/faq (quick example at the bottom).</div><div><br data-mce-bogus="1"></div><div>The 172.17 prefixes are declared in the FAQ too, so these are confirmed valid ranges. </div><div><br data-mce-bogus="1"></div><div>E.g.:</div><div><br></div><div><div>>>> a, u = sr(IP(dst='8.8.8.8') / UDP(sport=(12345, 12385), dport=53) / DNS(rd=1, qd=DNSQR(qname='whoami.akamai.net.', qtype='A', qclass='IN')))</div><div>Begin emission:</div><div>..****************.******************.****Finished to send 41 packets.</div><div>***</div><div>Received 45 packets, got 41 answers, remaining 0 packets</div><div>>>> set([x[1][DNSRR].rdata for x in a])</div><div>set(['74.125.73.84', '74.125.181.15', '74.125.47.138', '74.125.47.129', '74.125.47.140', '74.125.73.77', '74.125.47.142', '74.125.47.145', '74.125.181.5', '74.125.181.4', '74.125.73.67', '74.125.47.14', '74.125.73.69', '74.125.73.68', '74.125.73.79', '74.125.73.82', '74.125.73.80'])</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div><br></div><div><br data-mce-bogus="1"></div></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Babak Farrokhi" <babak@farrokhi.net><br><b>To: </b>"Rajesh Maskara" <rajmask@microsoft.com><br><b>Cc: </b>dns-operations@dns-oarc.net<br><b>Sent: </b>Thursday, October 19, 2017 4:44:31 PM<br><b>Subject: </b>Re: [dns-operations] Unpublished IP addresses for Google Public DNS<br></div><div><br></div><div data-marker="__QUOTED_TEXT__">
<div class="plaintext"><p dir="auto">Hi,</p>
<p dir="auto">I have seen several addresses from 172.217.42.x as source address from Google resolvers. Here is a list of IPs I’ve seen recently:</p>
<p dir="auto">172.217.42.3<br>
172.217.42.4<br>
172.217.42.5<br>
172.217.42.6<br>
172.217.42.7<br>
172.217.42.8<br>
172.217.42.9<br>
172.217.42.10<br>
172.217.42.11<br>
172.217.42.14</p>
<br><p dir="auto">Kind Regards,</p>
<p dir="auto">-- <br>
Babak Farrokhi</p>
<br><p dir="auto">On 12 Oct 2017, at 3:51, Rajesh Maskara wrote:</p>
</div>
<blockquote class="embedded">
<div lang="EN-US">
<div class="WordSection1">
<p class="MsoNormal">Are following two IP addresses used by Google Public DNS for DNS resolution?</p>
<p class="MsoNormal"> 172.217.42.2</p>
<p class="MsoNormal"> 172.217.42.4</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">These addresses are NOT included in published ranges:</p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">C:\>nslookup -type=TXT locations.publicdns.goog. | findstr "172.217."</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">Non-authoritative answer:</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.32.0/26 lhr "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.32.64/26 lhr "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">
</span><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">"172.217.32.128/26 sin "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.33.0/26 syd "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.33.64/26 syd "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.33.128/26 fra "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.33.192/26 fra "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.34.0/26 fra "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.34.64/26 bom "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.34.192/26 bom "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.35.0/24 gru "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.36.0/24 atl "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">
</span><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">"172.217.37.0/24 gru "</span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">This is resulting in Traffic Managers like DYN etc to map the end-users incorrectly to CA, USA.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks,<br>
Rajesh Maskara</p>
<p class="MsoNormal">Microsoft</p>
</div>
</div></blockquote>
<div class="plaintext"><blockquote>
</blockquote><blockquote><p dir="auto">_______________________________________________<br>
dns-operations mailing list<br>
dns-operations@lists.dns-oarc.net<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
dns-operations mailing list<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a></p>
</blockquote></div>
<br>_______________________________________________<br>dns-operations mailing list<br>dns-operations@lists.dns-oarc.net<br>https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>dns-operations mailing list<br>https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br></div></div></blockquote>
<div class="plaintext"><blockquote>
</blockquote></div>
</body>
</html>