Hacker News Reader

Comment by mekster | Hacker News Reader

Who are looking up PTR records?

54.in-addr.arpa looks to be Amazon's range and there are several others.

It's probably a lot of automated tooling/monitoring infrastructure that's doing reverse resolution of IPs to get hostnames.

Edit: I've found that sometimes they're pretty poor at caching responses so you end up with a lot of these requests.

Mail servers typically resolve a remote IP to a PTR. High number of PTR requests can indicate that the network is used to send email. Amazon (both SES and EC2) is one of the biggest email sources on the Internet (ranging from ham to marketing and there is huge spam volume from AWS too).

Thought I don’t expect mail servers to use quad9.

Why not?

I have unbound with upstream set to 1.1.1.1 and 9.9.9.9.

If you run a mail server it's good to have a local DNS cache, e. g. Unbound. And if you have Unbound adding an upstream is not that necessary - it can talk to root servers directly or use hoster's DNS as upstream. I rarely use services like Quad9 but IMHO the main use case is for home PC / notebooks: e. g. if an ISP neglected it's own DNS (and it doesn't work well) or if an ISP spoof NXDOMAIN to return ads; another use case is free Wi-Fi where DNS can also be misconfigured / unreliable.

For an ISP it's relatively easy to provide a DNS server which will be fast and reliable (and your ISP's DNS is close to you than some 3rd party DNS) if that's not the case they probably just don't care.

Reply on news.ycombinator.com