Non-existing domain

Is there any way to see if people have tried to get to non-existing
domains? I mean, if someone requests and it does not exist, is
the request logged anywhere?

If you really wanted to, you can rig their local nameserver to log it.
That will only tell you who looked up a non-existant name using that
particular nameserver though.

There is no, and due to the way DNS is designed, can be no one repository
for such logs.

There was (and I hope someone who recalls this better than I do jumps in
with more info) an experiment a while back where someone rigged one of the
root servers to log NXDOMAINs.. it turned out that the majority of the bad
requests were for stuff like "WORKGROUP." Sigh.


I did this with some of the RIPE folks when I worked at the LINX. The
results (from K, which remember is _only_ authoritative for .) roughly looked
like this:

25% of queries were for '.'
65% of queries were for 'foo.' where foo is NOT a valid TLD

The remaining 10% or so were for GTLD domains, valid TLDs etc.

Also of interest given the RFC1918 debate currently going on was the fact
that 5% of queries originated from 1918 address space.