Currently I am analyzing the DNS logs from various Windows servers. I am seeing lots of NXDOMAIN response from the DNS server. When I looked into the query field, it is something like 'NHCNEBDBEBEEBFEDCDCDFDBDEDEDDDCA' (strings of random length and all in caps). After looking around I came across this which explains it is the DNS anti-spoofing testing. I want to know whether it is completely normal and is performed by google chrome or there is something fishy like DOS attack going on.

Edit: Windows server are also acting as DNS servers and both are present behind the corporate firewall. Currently I am using Splunk Enterprise Security as SIEM tool. Splunk is raising the notable event "Excessive DNS Failures"

  • This is looking normal. You can capture the packets from a client and confirm. – schroeder Aug 13 '17 at 11:25

I verified that whenever Google chrome browser is launched, it generates series of such random queries (around 6-9) which is forcing the DNS server to return NXDOMAIN response. The link in the question helped me to verify the chrome behavior.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.