Hacker News Reader

This is the correct answer. The monitoring tool is sending the wrong kind of DNS queries to these servers, and these servers are filtering them out. You can argue the servers should at least respond with an error, however they are functioning correctly when you ask them for an authoritative response (i.e. a delegation)

View on HN

(monitoring tool author here) Agree. Makes sense. We should have run this test with RD bit unset.

But .. IIRC if RD is set when quering a non-recursive, it should respond normally with authoritative response Recursion Available (RA) flag unset. It does not mean it should drop the query totally.

Dropping bad queries is often a DDoS countermeasure.

Reply on news.ycombinator.com