DNS Query Flood from Lingering Hosting-Provider Glue Record

A Dataplane.org network sensor was assigned an IP address that had previously been used as a default nameserver glue record by a hosting provider for customer domains under .COM. Because the provider had not updated the glue record after reassigning the IP, all DNS queries for unconfigured customer domains continued to flow to the Dataplane.org sensor, up to 700,000 unsolicited queries per day.

The anomaly polluted the sensor’s DNS traffic data until the hosting provider was identified and persuaded to update the stale glue record. The incident is documented in the Dataplane.org newsletter.