<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><style></style><style>
div.plaintext { white-space: normal; }
body { font-family: sans-serif; }
div.plaintext h1 { font-size: 1.4em; }
div.plaintext h2 { font-size: 1.2em; }
div.plaintext h3 { font-size: 1.1em; }
blockquote.embedded,div.plaintext blockquote { margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #777777; color: #777777; }
blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote { border-left-color: #999999; color: #999999; }
blockquote.embedded blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote blockquote { border-left-color: #BBBBBB; color: #BBBBBB; }
div.plaintext a { color: #3983C4 }
blockquote.embedded,div.plaintext blockquote a { color: #777777; }
blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote a { color: #999999; }
blockquote.embedded blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote blockquote a { color: #BBBBBB; }
div.plaintext math[display="inline"] > mrow { padding:5px; }
div.plaintext div.footnotes li p { margin: 0.2em 0; }
</style></div><div>Maybe silly, but you could do some enumeration test with scapy and whoami from multiple vantage points to build your list, and cross the results with the subnets declared at https://developers.google.com/speed/public-dns/faq (quick example at the bottom).</div><div><br data-mce-bogus="1"></div><div>The 172.17 prefixes are declared in the FAQ too, so these are confirmed valid ranges. </div><div><br data-mce-bogus="1"></div><div>E.g.:</div><div><br></div><div><div>>>> a, u = sr(IP(dst='8.8.8.8') / UDP(sport=(12345, 12385), dport=53) / DNS(rd=1, qd=DNSQR(qname='whoami.akamai.net.', qtype='A', qclass='IN')))</div><div>Begin emission:</div><div>..****************.******************.****Finished to send 41 packets.</div><div>***</div><div>Received 45 packets, got 41 answers, remaining 0 packets</div><div>>>> set([x[1][DNSRR].rdata for x in a])</div><div>set(['74.125.73.84', '74.125.181.15', '74.125.47.138', '74.125.47.129', '74.125.47.140', '74.125.73.77', '74.125.47.142', '74.125.47.145', '74.125.181.5', '74.125.181.4', '74.125.73.67', '74.125.47.14', '74.125.73.69', '74.125.73.68', '74.125.73.79', '74.125.73.82', '74.125.73.80'])</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div><br></div><div><br data-mce-bogus="1"></div></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Babak Farrokhi" <babak@farrokhi.net><br><b>To: </b>"Rajesh Maskara" <rajmask@microsoft.com><br><b>Cc: </b>dns-operations@dns-oarc.net<br><b>Sent: </b>Thursday, October 19, 2017 4:44:31 PM<br><b>Subject: </b>Re: [dns-operations] Unpublished IP addresses for Google Public DNS<br></div><div><br></div><div data-marker="__QUOTED_TEXT__">
<div class="plaintext"><p dir="auto">Hi,</p>
<p dir="auto">I have seen several addresses from 172.217.42.x as source address from Google resolvers. Here is a list of IPs I’ve seen recently:</p>
<p dir="auto">172.217.42.3<br>
172.217.42.4<br>
172.217.42.5<br>
172.217.42.6<br>
172.217.42.7<br>
172.217.42.8<br>
172.217.42.9<br>
172.217.42.10<br>
172.217.42.11<br>
172.217.42.14</p>
<br><p dir="auto">Kind Regards,</p>
<p dir="auto">-- <br>
Babak Farrokhi</p>
<br><p dir="auto">On 12 Oct 2017, at 3:51, Rajesh Maskara wrote:</p>
</div>
<blockquote class="embedded">
<div lang="EN-US">
<div class="WordSection1">
<p class="MsoNormal">Are following two IP addresses used by Google Public DNS for DNS resolution?</p>
<p class="MsoNormal"> 172.217.42.2</p>
<p class="MsoNormal"> 172.217.42.4</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">These addresses are NOT included in published ranges:</p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">C:\>nslookup -type=TXT locations.publicdns.goog. | findstr "172.217."</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">Non-authoritative answer:</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.32.0/26 lhr "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.32.64/26 lhr "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">
</span><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">"172.217.32.128/26 sin "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.33.0/26 syd "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.33.64/26 syd "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.33.128/26 fra "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.33.192/26 fra "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.34.0/26 fra "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.34.64/26 bom "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.34.192/26 bom "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.35.0/24 gru "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';"> "172.217.36.0/24 atl "</span></p>
<p class="MsoNormal" style="margin-left: .5in;" data-mce-style="margin-left: .5in;"><span lang="ES" style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">
</span><span style="font-size: 10.0pt; font-family: 'Courier New';" data-mce-style="font-size: 10.0pt; font-family: 'Courier New';">"172.217.37.0/24 gru "</span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">This is resulting in Traffic Managers like DYN etc to map the end-users incorrectly to CA, USA.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks,<br>
Rajesh Maskara</p>
<p class="MsoNormal">Microsoft</p>
</div>
</div></blockquote>
<div class="plaintext"><blockquote>
</blockquote><blockquote><p dir="auto">_______________________________________________<br>
dns-operations mailing list<br>
dns-operations@lists.dns-oarc.net<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
dns-operations mailing list<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a></p>
</blockquote></div>
<br>_______________________________________________<br>dns-operations mailing list<br>dns-operations@lists.dns-oarc.net<br>https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>dns-operations mailing list<br>https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br></div></div></body></html>