isc domain lookup

[Mark Andrews]

Someone trying to block isc.org/any queries in a firewall to prevent
their servers being used in a amplification attack and causing
collateral damage through a badly designed rule.

Mark

In message <CAPLzrxrary1OtFBFmfL7Svny-AiC7hXPW9c3xRU11U4oYhzOwA at mail.gmail.com>, Yossi Eskenazi writes:
> 
> Hello,
> 
> My question is not directly related to bind, but since it's related to isc
> I decided to ask here.
> 
> Some name servers I perform a lookup does not respond to queries, if they
> begin with "isc"
> 
> Example server : 213.143.254.38
> Query for any domain, it responds. Sometimes it times out, but ask again ,
> it eventually responds.
> Query for "isc.com" "isc.org" "isc.whatever.it.is" or just "isc",  it times
> out.
> 
> Example server: 185.15.40.80
> Query for any domain, it says "query refused"
> Query for "isc.com" "isc.org" "isc.whatever.it.is" or just "isc",  it times
> out.
> 
> It's not just these two, there are other name servers behaving this way.
> 
> What can be the reason for this?
> 
> Thanks for your help
> 
> Y.E.
> 
> --001a11c2bb4c08b70a04f96256d4
> Content-Type: text/html; charset=UTF-8
> Content-Transfer-Encoding: quoted-printable
> 
> <div dir=3D"ltr">Hello,<div><br></div><div>My question is not directly rela=
> ted to bind, but since it's related to isc I decided to ask here.</div>=
> <div><br></div><div>Some name servers I perform a lookup does not respond t=
> o queries, if they begin with "isc"</div>
> <div><br></div><div>Example server : <span style=3D"font-family:'Helvet=
> ica Neue',Arial,Helvetica,sans-serif;font-size:12px;line-height:18px">2=
> 13.143.254.38</span></div><div><span style=3D"font-family:'Helvetica Ne=
> ue',Arial,Helvetica,sans-serif;font-size:12px;line-height:18px">Query f=
> or any domain, it responds. Sometimes it times out, but ask again , it even=
> tually responds.</span></div>
> <div><span style=3D"font-family:'Helvetica Neue',Arial,Helvetica,sa=
> ns-serif;font-size:12px;line-height:18px">Query for "<a href=3D"http:/=
> /isc.com">isc.com</a>" "<a href=3D"http://isc.org">isc.org</a>&qu=
> ot; "<a href=3D"http://isc.whatever.it.is">isc.whatever.it.is</a>&quot=
> ; or just "isc", =C2=A0it times out.</span></div>
> <div><br></div><div><span style=3D"font-family:'Helvetica Neue',Ari=
> al,Helvetica,sans-serif;font-size:12px;line-height:18px">Example server: 18=
> 5.15.40.80</span></div><div><font face=3D"Helvetica Neue, Arial, Helvetica,=
>  sans-serif"><span style=3D"font-size:12px;line-height:18px">Query for any =
> domain, it says "query refused"</span></font></div>
> <div><span style=3D"font-family:'Helvetica Neue',Arial,Helvetica,sa=
> ns-serif;font-size:12px;line-height:18px">Query for "<a href=3D"http:/=
> /isc.com">isc.com</a>" "<a href=3D"http://isc.org">isc.org</a>&qu=
> ot; "<a href=3D"http://isc.whatever.it.is">isc.whatever.it.is</a>&quot=
> ; or just "isc", =C2=A0it times out.</span><br>
> </div><div><span style=3D"font-family:'Helvetica Neue',Arial,Helvet=
> ica,sans-serif;font-size:12px;line-height:18px"><br></span></div><div><span=
>  style=3D"font-family:'Helvetica Neue',Arial,Helvetica,sans-serif;f=
> ont-size:12px;line-height:18px">It's not just these two, there are othe=
> r name servers behaving this way.</span></div>
> <div><span style=3D"font-family:'Helvetica Neue',Arial,Helvetica,sa=
> ns-serif;font-size:12px;line-height:18px"><br></span></div><div><span style=
> =3D"font-family:'Helvetica Neue',Arial,Helvetica,sans-serif;font-si=
> ze:12px;line-height:18px">What can be the reason for this?</span></div>
> <div><span style=3D"font-family:'Helvetica Neue',Arial,Helvetica,sa=
> ns-serif;font-size:12px;line-height:18px"><br></span></div><div><span style=
> =3D"font-family:'Helvetica Neue',Arial,Helvetica,sans-serif;font-si=
> ze:12px;line-height:18px">Thanks for your help</span></div>
> <div><span style=3D"font-family:'Helvetica Neue',Arial,Helvetica,sa=
> ns-serif;font-size:12px;line-height:18px"><br></span></div><div><span style=
> =3D"font-family:'Helvetica Neue',Arial,Helvetica,sans-serif;font-si=
> ze:12px;line-height:18px">Y.E.</span></div>
> <div><span style=3D"font-family:'Helvetica Neue',Arial,Helvetica,sa=
> ns-serif;font-size:12px;line-height:18px">=C2=A0</span></div></div>
> 
> --001a11c2bb4c08b70a04f96256d4--
> 
> --===============1502673652868917195==
> Content-Type: text/plain; charset="us-ascii"
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> 
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
> 
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
> --===============1502673652868917195==--
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org