underscores in A queries

[Kevin K]

Hi, 

I've been parsing my query logs to watch for unusual/unexpected lookups, and I notice quite a few A queries with underscores, often in patterns like 

_.domainname.com 

often followed by 

_.xyz.domainname.com 

or 

_.domainname.com.mydomain.com 

Can someone tell me what these are and what the underscores mean? 


thanks 

Kevin 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20210409/1d25e843/attachment.htm>