DNS queries that go nowhere

I ran a small experiment over a weekend: log every outbound DNS query from one device on my home network, do nothing with that device, and see how many queries it generates on its own. The answer turned out to be about three hundred per hour, almost all of them for hostnames I had never typed.

A handful were obvious — clock sync, certificate revocation checks, the captive-portal detection that every operating system now ships. Most were less obvious. There was a long tail of queries for things like connectivitycheck.something, edge-mqtt.something, telemetry-something, and a surprising number for localhost appended with random search-domain suffixes. The latter is, I am told, a long-standing artefact of the ndots resolver setting.

Once you have the list, you can graph it. Once you have graphed it, you can start removing things. I am not going to tell you which queries I block; the answer depends on whose device it is and what you actually use. The interesting outcome of the exercise was not the blocklist. It was the realisation that an idle laptop is, from the network's point of view, not idle at all.

If you have not done this on your own network, it is worth a Saturday. The tool is whatever DNS server you already run; dnsmasq with log-queries works fine. Watch a single device for an afternoon. You will be surprised, and then mildly annoyed, and then a little fascinated.