I recently completed a "software pilgrimage", as I decided to call it in explaining to friends why I did it, of writing my own DNS recursive resolver. I decided to implement it purely from RFC 1034/1035, with no library code aside from TCP and UDP sockets and a JSON config parser, those kinds of things. No library help for anything relating to the RFC. It's part of a homelab-focused DNS solution that I plan to release under the AGPLv3 once I dogfood it for a while. Basically "DNS for impatient homelabbers/SMB's who don't want to have to learn how to write zonefiles and don't want some crazy enterprise omnibus thing either".
Anyway, in the process of doing this and putting it in my DHCP config and seeing the traffic from two smart TVs of different brands, my RIPE atlas probe, various phones and laptops, smart thermostat, etc etc, I've noticed that there is a TON of "garbage" dns requests. Like, the chart [the article] shows - where about 70% of queries result in a name error - that totally meshes with what I see on a much smaller scale. Right now, prometheus tells me that since last restart (which was about a week ago at this point?), I've answered 80437 queries with NO_ERROR, 52014 with NAME_ERROR, and 242 with SERVER_FAILURE (funnily enough, when spot checking these, 8.8.8.8 also SERVER_FAILUREs these same requests - usually devices with presumably-buggy dns libraries not correctly specifying lengths of variable-length fields).
It really surprised my initial suspicions that so many DNS requests would be coming up with what I was originally considering to be an error condition. But I guess sometimes the absence of a DNS record is just as meaningful as the presence.
Incidentally, I also noticed these chromium dns requests, and they had me worried for a bit because I wondered if they were malware trying to exploit some kind of vuln in dns servers. Took a bit of googling to figure it out. I do think they make up a decent % of the name errors I see, though I hadn't gotten around to having prometheus split them out to measure.
Anyway, in the process of doing this and putting it in my DHCP config and seeing the traffic from two smart TVs of different brands, my RIPE atlas probe, various phones and laptops, smart thermostat, etc etc, I've noticed that there is a TON of "garbage" dns requests. Like, the chart [the article] shows - where about 70% of queries result in a name error - that totally meshes with what I see on a much smaller scale. Right now, prometheus tells me that since last restart (which was about a week ago at this point?), I've answered 80437 queries with NO_ERROR, 52014 with NAME_ERROR, and 242 with SERVER_FAILURE (funnily enough, when spot checking these, 8.8.8.8 also SERVER_FAILUREs these same requests - usually devices with presumably-buggy dns libraries not correctly specifying lengths of variable-length fields).
It really surprised my initial suspicions that so many DNS requests would be coming up with what I was originally considering to be an error condition. But I guess sometimes the absence of a DNS record is just as meaningful as the presence.
Incidentally, I also noticed these chromium dns requests, and they had me worried for a bit because I wondered if they were malware trying to exploit some kind of vuln in dns servers. Took a bit of googling to figure it out. I do think they make up a decent % of the name errors I see, though I hadn't gotten around to having prometheus split them out to measure.