> On 23 Feb 2023, at 22:36, Ted Lemon <mel...@fugue.com> wrote: > > How much DNS traffic is even still inspectable these days?
Depends on the definition of DNS traffic Ted. DNS-OARC has many TB of pcaps and query logs from the DITL project. Whether that data could be good enough to meaningfully measure the incidence of QDCOUNT>1 in the real world is anyone’s guess. I suppose it’ll be difficult (and very subjective) to distinguish between “real” QDCOUNT>1 queries and the ones from junk implementations that are just part of the DNS’s background noise. _______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
