Thanks for looking into this. I've filed it as a github issue now. As a workaround I'm now trying to block these DNS queries in dnsdist, so they do not reach recursor and the logs: addAction(QTypeRule(qtype from the logs), RCodeAction(DNSRCode.NOTIMP)) best regards, Christoph