mnordhoff
Joined 17 years ago
Karma
199
Submissions
111
Member since
Dec 7
Joined 17 years ago
Sometimes the upstream blocklist provider will be easy to contact directly as well. Sometimes not so much.
$ dig +short ns1.digitalocean.com aaaa
2400:cb00:2049:1::adf5:3a33
$ dig +short ns1.linode.com aaaa
2400:cb00:2049:1::a29f:1a631.1.1.2 and 1.1.1.3 both return the SVCB records for 1.1.1.1. (I don't know if clients would ignore them, or actually switch to 1.1.1.1.)
Non-SVCB-type queries for _dns.resolver.arpa return NXDOMAIN instead of NOERROR. (This probably doesn't have significant impact, but might break it for some clients, e.g. if they can be tricked into making queries for _dns.resolver.arpa, or if a downstream resolver makes DS queries.)