About EBOT queries

You might encounter a record type labeled EBOT when reviewing query statistics returned by the IBM® NS1 Connect® API. This is not a DNS record type you can configure but rather a virtual record type used to provide more detailed reporting on queries for non-existent records in your zones.

EBOT stands for Exists But Other Type. Typically, NS1 Connect responses count as EBOT queries when AAAA queries are made against records in your zone that exist as A records (IPv4) but have no AAAA (IPv6) versions. By RFC 4074, when an AAAA query is made, and no AAAA exists, but an A record with the same name exists, we return response code 0 (NOERROR) with an empty answer section and an authoritative SOA record. This indicates to the recursor that they should re-query the name as an A record, which will exist. We count this type of query/response as an EBOT query so we can provide more detailed reporting on how many such queries occur.

It is typical for recursive nameservers to first query AAAA for a domain and check the response, even if you've only asked for the A record. If NS1 Connect were to return a non-existent domain (NXDOMAIN) response, it would indicate that neither AAAA nor A records exist for that name. If NOERROR is returned (the EBOT situation), the recursor issues another query to retrieve the result of the A record.

EBOT queries are not billed separately or specially from the rest of your traffic. Whereas most DNS providers lump all queries related to a zone together when invoicing, NS1 Connect breaks out EBOT queries specifically to differentiate between this common type of query and true NXDOMAIN traffic for domains that do not exist so you can better understand traffic sources.

If you are seeing unusually high EBOT traffic, check the TTL of your SOA record and the NXDOMAIN TTL of your SOA. RFC 2308 instructs authoritative servers to select the minimum of these two values and construct a new SOA record to be served in the case of NXDOMAIN or EBOT behavior. Increasing whichever is the minimum value will decrease your EBOT query volume under many circumstances.