With BIND (named) enabled on an OS-X Lion iMac, I can get a list of queries as they occur. In the list are some very strange entries, listed below. Can anyone shed some light on these? (Note that the iMac is at :

query: xdnrhkbqnn IN A + (
query: rvdldbxroe IN A + (
query: dtzmkqjwwc IN A + (
query: edyidthaxc IN A + (
query: bqjmeqglim IN A + (
query: sixelsjzvf IN A + (
query: c. IN PTR + (
query: IN PTR + (
query: b._dns-sd._udp. IN PTR + (
query: db._dns-sd._udp. IN PTR + (
query: r._dns-sd._udp. IN PTR + (
query: dr._dns-sd._udp. IN PTR + (
query: lb._dns-sd._udp. IN PTR + (
query: c. IN PTR + (

1 Answer 1


In order:

  1. Six entries caused by Google Chrome checking — twice, apparently — to see if you are the victim of an ISP, or an external advertiser-driven proxy DNS provider, that does NXDOMAIN hijacking.
  2. One perfectly ordinary IPv6 address→name lookup for an address in the FD00::/8 block.
  3. One perfectly ordinary IPv4 address→name lookup for an address in
  4. Five perfectly ordinary DNS Service Discovery/Bonjour browse lookups for what is presumably the LAN (
  5. One perfectly ordinary IPv6 address→name lookup for another address in the FD00::/8 block.

Further reading

  • S. Thomson, C. Huitema, V. Ksinant, and M. Souissi (October 2003). "IP6.ARPA domain". DNS Extensions to Support IP Version 6 . RFC 3596. Requests for Comments.
  • Thanks very much and thanks for the link - interesting :-) Hoping not to try your patience, how does one determine the FD00::/7 from the long string of numbers? and who/what/where might be using IPv6 on the box? Jan 24, 2012 at 0:09
  • @WilliamMorris: The numbers for ip→name lookups are backwards so that hierarchy works out right.
    – freiheit
    Jan 24, 2012 at 0:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .