Currently I am analyzing the DNS logs from various Windows servers. I am seeing lots of NXDOMAIN response from the DNS server. When I looked into the query field, it is something like 'NHCNEBDBEBEEBFEDCDCDFDBDEDEDDDCA' (strings of random length and all in caps). After looking around I came across this which explains it is the DNS anti-spoofing testing. I want to know whether it is completely normal and is performed by google chrome or there is something fishy like DOS attack going on.
Edit: Windows server are also acting as DNS servers and both are present behind the corporate firewall. Currently I am using Splunk Enterprise Security as SIEM tool. Splunk is raising the notable event "Excessive DNS Failures"