<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Mark,<div class=""><br class=""></div><div class="">The quarries for TXT/<a href="http://a.b.qnamemin-test.nlnetlabs.nl" class="">a.b.qnamemin-test.nlnetlabs.nl</a> are not coming from NLnetlabs but from a Swedish research project.</div><div class="">Rapid7 produces a list of ip addresses with alleged resolvers on port 53.</div><div class="">We check all those resolvers for min.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">/Ulrich</div><div class=""><br class=""></div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 13 Feb 2022, at 06:38, Mark Delany <<a href="mailto:b9w@charlie.emu.st" class="">b9w@charlie.emu.st</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">(A free DNS lookup for anyone who remembers that movie quote).<br class=""><br class="">I guess I'm just lamenting how much junk DNS traffic there is "out there". I know, I<br class="">know. Old news.<br class=""><br class="">I recently built a toy server to experiment with configless ipv6 reverse answers and a<br class="">side-effect is that I scrutinized all the queries for an extended period. Big mistake!<br class=""><br class="">Apart from the incessant, apparent DDOS to ANY/<a href="http://pizzaseo.com" class="">pizzaseo.com</a>, ANY/<a href="http://peacecorps.gov" class="">peacecorps.gov</a> and the<br class="">like thrown at all port 53 ipv4 addresses, there is also the inexplicable and also<br class="">incessant ANY/sl. queries. What they do or who they are meant to hurt, I have no clue.<br class=""><br class="">But even the good guys are pretty unrelenting:<br class=""><br class="">I see 60+ queries per day, every day for TXT/<a href="http://a.b.qnamemin-test.nlnetlabs.nl" class="">a.b.qnamemin-test.nlnetlabs.nl</a> coming from<br class="">just three AWS instances. Is that really nlnetlabs? If so, what are they hoping to<br class="">measure?<br class=""><br class="">Similarly:<br class=""><br class="">30/day A/<a href="http://ip.parrotdns.com" class="">ip.parrotdns.com</a> by <a href="http://censys-scanner.com" class="">censys-scanner.com</a><br class="">24/day A/<a href="http://cb00780e.asert-dns-research.com" class="">cb00780e.asert-dns-research.com</a><br class=""><br class="">And what <a href="http://hetzner.com" class="">hetzner.com</a> are up to I also have no clue, but they're pretty incessantly sending<br class="">qmin type A queries.<br class=""><br class="">I know that the reverse range being queried is not very active, so these reverse queries<br class="">are definitely not being triggered by outbound connections.<br class=""><br class="">Speaking of qname minimization, hoy boy, do they generate a lot of extra queries in the<br class="">ipv6 reverse tree! I do wonder what secrets are being kept safe by not telling a parent<br class="">name server what lower level PTR someone is after, but I'm sure there's good justification<br class="">for it.<br class=""><br class="">Not that it's a lot of traffic and I know there is zero I can do about it, but I'm down to<br class="">30% of queries actually returning an answer, with >50% returning qmin NOERRORs and the rest<br class="">REFUSED.<br class=""><br class=""><br class="">Bah humbug.<br class=""><br class=""><br class="">Mark.<br class=""><br class="">PS. Rotten Tomatoes gets it wrong with this one.<br class=""><br class="">_______________________________________________<br class="">dns-operations mailing list<br class=""><a href="mailto:dns-operations@lists.dns-oarc.net" class="">dns-operations@lists.dns-oarc.net</a><br class="">https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br class=""></div></div></blockquote></div><br class=""></div></body></html>