Hi Peter,
On 2 Mar 2020, at 10:31, Peter Koch <pk@DENIC.DE> wrote: ... It might be interesting to see whether the query sources are "heavy" or re-occuring users or other signs for the queries being largely for consistency checks. All in all, likely a side issue.
It was straightforward to count these queries by client address. Of the 422,061 queries with the reverse domain flag (-d/--reverse-domain): * There were 1,460 client IP's in total. * 314,239 (74%) of queries didn't return anything (no matching object, or malformed query such as "in-addr.arpa" or "ip6.arpa"). * 3 clients accounted for 44% of the queries that did return at least one object. Of the 758,583 queries for domain objects by primary key (*.in-addr.arpa|ip6.arpa|e164.arpa): * There were 26,073 client IP's in total. * 501,457 (66%) queries didn't return anything. * 4 clients accounted for 65% of the queries that did return at least one object. Regards Ed