This is what recursive DNS looks like these days.

It seems some people eventually break things by updating their authoriative Servers hence the Server Failure responses and then there are these suspicious NXDOMAIN spikes. I was not yet able to pinpoint who asks what there but those could very well be spoofing attempts coming from our clients.

Not that they had any chance of succeeding we’re running PowerDNS recursor and have uRPF is deployed on everything ingres, so no spoofing there.