I was doing some testing lately that involved re-ruoting (proxying) regular DNS queries on a personal Mac OS X machine through my software and back to the DNS server of my ISP.

I had the opportunity to see all the queries from regular computer usage being made. And these ones made me curious:


I read somewhere that these are from Apple's Bonjour service discovery. But isn't that supposed to work only on local network, so what would be the purpose of sending those queries to the ISP's DNS server?! Are those guys flooded with a boatload of these queries from people owning macs?! What am I missing here?

UPDATE: I've just checked the response data from these queries and it is always the same. I see the following:




Mentioned in every response (note: I'm looking at raw data, so I might not be decoding this properly. I see, by googling, that others are getting hostmaster.root-servers.org but I see no org in the raw bytes of my responses)

migrated from serverfault.com Apr 28 '14 at 7:14

This question came from our site for system and network administrators.

  • This is off-topic for ServerFault. I'm going to answer anyway because I don't see a dupe close candidate on SuperUser. (where this should be migrated to) – Andrew B Apr 28 '14 at 1:31
  • This is not a reverse DNS lookup. It is indeed DNS Service Discovery. Although that would normally be used in multicast DNS, not unicast DNS. – Daniel B Apr 28 '14 at 7:52
  • Andrew B changed my somewhat ugly topic to "Why does reverse DNS for private networks get sent to my ISP?" so I actually never said it was a reverse DNS lookup. I've changed the topic now. I also must say that this was not so off-topic for serverfault, beacause the question might have been looked at from a sys admin perspective. For example network/protocol architecture, positives/negatives how it could have been done and how these queries are handled by "professional system and network administrators". – Ivan Kovacevic Apr 28 '14 at 9:59
  • The in-addr.arpa suffix made this a reverse DNS question at its core, particularly because you were also inquiring about prisoner.iana.org -- the blackholing servers. At that point I was trying to tool the question toward being reusable for future dupe-closing. Regarding topicality, this involved observations made on a personal device, and reverse DNS (in-addr.arpa) leaking out to your ISP. Please consult meta.SF if you have further questions, this has been discussed exhaustively. – Andrew B Apr 28 '14 at 13:46
  • I understand. And thanks for your answer! – Ivan Kovacevic Apr 29 '14 at 15:30

Your computer's resolver library has no concept of what is private address space and what is not. Any request for a reverse DNS lookup is going to be sent to the DNS servers your machine is configured to use.

Likewise, your client applications have no knowledge of whether your configured DNS servers are operated by you, or some other entity. The best they can do is attempt to use DNS for autodiscovery, and hope that you are operating your own DNS infrastructure that is authoritative for your LAN.

In a residential/enthusiast scenario, the most common case is that you're using your ISP's DNS servers. The queries for private network reverse DNS are going to "leak" to your ISP. There's no way around that in the DNS specification; this is considered normal operation. How the ISP responds at that point is completely up to them. These are the most common cases:

  • The ISP manages their own authoritative reverse DNS for private network space, and is exposing it to the customer. Often this results in you discovering the DNS entry for the machine holding that IP address on their network. (oops)
  • The ISP doesn't consider itself authoritative for that IP space, and they "leak" the query up to IANA's top level nameservers for reverse DNS. The prisoner.iana.org. authority data that you're seeing comes from IANA's blackholing servers. You can read more about them in the provided link, but the short version is that leakage of private network reverse DNS is incredibly common and these servers are set up to take the load off of IANA's real ones.
  • The nameserver software (or server operators) are more considerate than most and blackhole the query themselves. This is by far the least likely scenario. BIND implemented such a feature in 9.4.1. It is controlled by empty-zones-enable (default: yes), and the data returned is influenced by the empty-server and empty-contact options.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.