Re: [dns-operations] DoH at authorities

2025-03-01 Thread John R Levine
On Sat, 1 Mar 2025, Jerry Lundström wrote: They're from Alibaba in China but have a fake Go-http-client/1.1 user agent. Why do you think it's fake? That's the default UserAgent [1] for Go's net http module. Good point, could be real. Still rather spammy, though. Regards, John Levine, jo...

Re: [dns-operations] DoH at authorities

2025-03-01 Thread John R Levine
On Fri, 28 Feb 2025, Jared Mauch wrote: Yes. I'm just logging them for now, found in web logs while verifying something else - so many side quests Huh, now that I look I'm seeing bursts of them too. They're from Alibaba in China but have a fake Go-http-client/1.1 user agent. Perhaps I will

Re: [dns-operations] DoH at authorities

2025-03-01 Thread Jerry Lundström
On 2/28/25 18:22, John R Levine wrote: They're from Alibaba in China but have a fake Go-http-client/1.1 user agent. Why do you think it's fake? That's the default UserAgent [1] for Go's net http module. /Jerry [1] https://cs.opensource.google/go/go/+/refs/tags/go1.24.0:src/net/http/request

Re: [dns-operations] DoH at authorities

2025-02-28 Thread Jared Mauch
Yes. I'm just logging them for now, found in web logs while verifying something else - so many side quests Sent via RFC1925 compliant device > On Feb 28, 2025, at 12:36 PM, John Levine wrote: > > It appears that Jared Mauch said: >> >> I was working on something else and discovered that

Re: [dns-operations] DoH at authorities

2025-02-28 Thread John Levine
It appears that Jared Mauch said: > >I was working on something else and discovered that there are people >sending DoH queries to the web server at my authority, and i went to >decode it to see if it was something that I should expect or not. What path are they using? /dns-query or something els

Re: [dns-operations] DoH at authorities

2025-02-28 Thread Stephane Bortzmeyer via dns-operations
--- Begin Message --- On Fri, Feb 28, 2025 at 11:10:04AM +, Jared Mauch wrote a message of 29 lines which said: > It appears to just be recursive query as decoded below. Instead of > serving them up a 404 page, I'm likely going to start logging and > storing these. I could send back what

[dns-operations] DoH at authorities

2025-02-28 Thread Jared Mauch
I was working on something else and discovered that there are people sending DoH queries to the web server at my authority, and i went to decode it to see if it was something that I should expect or not. It appears to just be recursive query as decoded below. Instead of serving them up a 404 pa