Many of us, myself included, have been tempted to be lazy when picking an 'example' IP when creating documentation or needing to use a dummy IP in a configuration somewhere. This laziness has now reared its ugly head and we're going to need to spring into action.
Until recently, the IP address 1.1.1.1 was not perceived as actively being 'in use' as there was no service associated to it, no website to pop up when dropped into a browser. It made its entrance in many labs, documentation, and even production configuration.
'Unfortunately' (for us lazy people), the IP has now been released to CloudFlare by APNIC (Regional Internet Registry, responsible for the Asia Pacific region out of five regions of global IP allocations), who until recently had the IP assigned to their own research group but were unable to process the immense amount of garbage traffic generated by people using this IP in production environments.
In a related but unrelated infomercial: 4.2.2.2 to 4.2.2.6 are often used as DNS servers, but belong to Level-3 and are technically not open DNS. Although Level-3 allows non-customers to use their services, they could theoretically decide to discontinue or block outsiders at any time.
You'll still want to go ahead and review your configuration to make sure you're not accidentally sending out any (potentially sensitive) packets.
Having the IP set in DNS sinkhole could cause malicious packets to be sent to the DNS service If the outbound connections are not being blocked by a security policy.
Help spread the word and educate users and admins alike.
I've been using 1.1.1.1 as a DNS sinkhole IP, I suppose its time to change that.
I've always recommended using bogon addresses for both the IPv4 and IPv6 DNS sinkhole addresses. Bogons are reserved address spaces that are filtered out on the Internet but are not typically filtered in enterprise WAN environments and will therefore get routed to the Internet perimeter.
The addresses I typically use are 192.0.0.1/32 and 2600:5200::1/128.
Hi @rhagen, thanks for the pointer! i'll add that for more freedom of choice!