Millions of NS queries for simple website

The reverse DNS for that IP is dnsregistrygw01.1and1.org. Maybe they have some sort of monitoring system that went haywire.

(The TTL wasn't set to 0 or something, was it?)

Thanks for the reply.

I thought it may have been something like that, but wouldn't the issue stop once I reversed the NS entries in IONOS? I did check and it appears to be propagated worldwide.

Which TTLs are you refering to?

Here are my AWS TTLs, it doesn't appear I can change it for that A record:
https://foxy-roxy-public-bucket.s3.amazonaws.com/Screenshot_from_2021-02-26+14-47-35.png

Doesn't look like IONOS has this exposed to their customers. They say changes may take up to 48 hours so perhaps the typical 172800 for NS entries?

FoxyRoxy wrote:
I thought it may have been something like that, but wouldn't the issue stop once I reversed the NS entries in IONOS? I did check and it appears to be propagated worldwide.

Maybe. There's no way for us to know how the software -- whatever it is -- on 82.165.226.228 is supposed to work.

Which TTLs are you refering to?

Here are my AWS TTLs, it doesn't appear I can change it for that A record:
https://foxy-roxy-public-bucket.s3.amazonaws.com/Screenshot_from_2021-02-26+14-47-35.png

I meant the response to www.roxanalifshitz.com NS on AWS. The negative TTL in your screenshot would be 900 seconds, so assuming AWS isn't buggy, a normal resolver should cache the response and shouldn't make so many queries.

Aww well I didn't realize that IP was the source of these calls, I didn't even look it before. I think the "resolverIP" label confused me.

Anyways, like you mentioned before it's definitely coming from my registrar, probably not an AWS issue. Time to get on the phone with IONOS again....

Thanks for being a sounding board, I'll mark this as answered.