I've been running ns1.acmehosting.com and ns2.acmehosting.com for several years as authoritative nameservers for several hundred domains. I've recently added ns3.acmehosting.com, hosted in another data center.

I've updated the domain registration for acmehosting.com and added ns3 as a nameserver. I've added an NS record to acmehosting.com for ns3.

ns3 has been fully configured (using bind) as a slave and all my zones are loaded and responding properly.

Here's the puzzling part: of the hundreds of domains I host, I've only so far updated the registration and NS records for three of them: acmehosting.com, abcd.com, and wxyz.com

As expected, when I run dnstop, I see several queries for the above three domains. But I also see occasional queries, from a variety of client IP addresses, for other domains I host, even though I haven't yet updated their domain registration with ns3 as a third nameserver, nor have I added the third NS record to the zones for those domains.

Why are these domains getting queried, and how do clients even know to query ns3 before I've updated the domain registrations or NS records?

Is it because ns3.acmehosting.com has already been fully configured? Are clients somehow assuming/extrapolating that a third nameserver exists from the other available records?

  • 2
    Probably just lots of network probing for testing for recursive servers, to be used in DDoS attacks. – Zoredache Apr 14 '17 at 17:05
  • Difficult to help you without seeing the true names involved. But no, clients are not inventing nameservers names. If they find out about ns3 it is because it is listed somewhere (or you just observe random probes) – Patrick Mevzek Apr 16 '17 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.