<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">This is was my thought as well. People always get up in arms about how it's "Public DNS!" but it's really not. It's just well known and used because it's easy to remember.</div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><font color="#000000" face="arial, helvetica, sans-serif"><br>- Mike Bolitho</font></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Nov 19, 2019 at 9:28 AM Ryan, Spencer <<a href="mailto:spencer.ryan@netscout.com">spencer.ryan@netscout.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_2112721305450385556WordSection1">
<p class="MsoNormal">Are you a CL/L3 customer? Those resolvers have only ever been for “customers” even though they would resolve for anyone. They started injecting NXDOMAIN redirects a while ago for non-customers.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> NANOG <<a href="mailto:nanog-bounces@nanog.org" target="_blank">nanog-bounces@nanog.org</a>> <b>On Behalf Of
</b>Marshall, Quincy<br>
<b>Sent:</b> Monday, November 18, 2019 12:45 PM<br>
<b>Subject:</b> Level(3) DNS Spoofing All Domains<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<table border="1" cellspacing="0" cellpadding="0" width="100%" style="width:100%;background:rgb(252,155,134)">
<tbody>
<tr>
<td style="padding:0in">
<p class="MsoNormal" align="center" style="text-align:center"><span style="color:black">This message originated outside of NETSCOUT. Do not click links or open attachments unless you recognize the sender and know the content is safe.</span><u></u><u></u></p>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal">This is mostly informational and may have already hit this group. My google-foo failed me if so.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I discovered that the CenturyLink/Level(3) public DNS (4.2.2.2, etc) are spoofing all domains. If the hostname begins with a “w” and does not exist in the authoritative zone these hosts will return two Akamai hosts.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">[root@localhost ~]# dig +short <a href="http://w3.dummydomaindoesntexist.gov" target="_blank">w3.dummydomaindoesntexist.gov</a> @<a href="http://4.2.2.2" target="_blank">4.2.2.2</a><u></u><u></u></p>
<p class="MsoNormal">23.202.231.167<u></u><u></u></p>
<p class="MsoNormal">23.217.138.108<u></u><u></u></p>
<p class="MsoNormal">[root@localhost ~]# dig +short <a href="http://w3.dummydomaindoesntexist.net" target="_blank">w3.dummydomaindoesntexist.net</a> @<a href="http://4.2.2.2" target="_blank">4.2.2.2</a><u></u><u></u></p>
<p class="MsoNormal">23.202.231.167<u></u><u></u></p>
<p class="MsoNormal">23.217.138.108<u></u><u></u></p>
<p class="MsoNormal">[root@localhost ~]# dig +short <a href="http://w3.dummydomaindoesntexist.com" target="_blank">w3.dummydomaindoesntexist.com</a> @<a href="http://4.2.2.2" target="_blank">4.2.2.2</a><u></u><u></u></p>
<p class="MsoNormal">23.202.231.167<u></u><u></u></p>
<p class="MsoNormal">23.217.138.108<u></u><u></u></p>
<p class="MsoNormal">[root@localhost ~]# dig +short <a href="http://w3.dummydomaindoesntexist.org" target="_blank">w3.dummydomaindoesntexist.org</a> @<a href="http://4.2.2.2" target="_blank">4.2.2.2</a><u></u><u></u></p>
<p class="MsoNormal">23.202.231.167<u></u><u></u></p>
<p class="MsoNormal">23.217.138.108<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">My apologies if this is old news.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-family:"Calibri Light",sans-serif;color:rgb(95,73,122)">Lawrence Q. Marshall</span></b><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:10pt;font-family:Arial,sans-serif">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">This email has been scanned for email related threats and delivered safely by Mimecast.<br>
For more information please visit <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.mimecast.com&d=DwMFaQ&c=Hlvprqonr5LuCN9TN65xNw&r=VfFQaWKwN0L3efDXtkWoSUKlJtu8LJ9Ke5bevkfX6C0&m=q6vn3t-QWxYOtFEQ5UhCttLDcerYncizhmA0BXauzSg&s=0udD7os_Gb1eyxuW47ezLZB2f-gk_Ipxso3m4n80kqg&e=" target="_blank">
http://www.mimecast.com</a> <u></u><u></u></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:10pt;font-family:Arial,sans-serif">
<hr size="2" width="100%" align="center">
</span></div>
</div>
</div>
</blockquote></div>