The two options are both “No”. If you aren’t going to give an option, don’t give an option. It’s confusing to have two options that are the same thing.
If you blocked it at the DNS level, I’m surprised the error wasn’t a resolution failure. Who’s on the other side of this connection pretending to be Google Analytics??
You’re probably right. Rather than responding with NXDOMAIN, they’re probably synthesizing A or AAAA records that point to their own server. IMO, this is super weird behavior in the era of HTTPS. I’m also pretty sure there’s an IETF RFC that says recursive resolvers “MUST NOT” synthesize address records, but I can’t seem to dig it up on my phone (pun intended ;).
Add comment