This might not be the right place for this question but I see DNS request that seem to have a recordtype = ZERO in my splunk logs. I don't know what would be causing this, it doesn't seem like a valid type that DNS would even let you query for.
2/13/2019 11:48:59 AM 14E8 PACKET 000000A722BE61B0 UDP Rcv 10.10.10.106 d751 Q [0001 D NOERROR] ZERO www.microsoft.com
I am seeing tons of these from different client on different servers for different queries. Doesn't seem like they get passed on to the downstream DNS for resolution, but I don't know if this ZERO record is a hiccup on the DNS servers or with clients there are times when see thousands of them and normally it is like a few hundred. Anyone else have Microsoft DNS logs and see random queries for record type ZERO?
Thank you,
Brian Kirk
