Maybe a DNS guru out there can help me out since I don't suspect the activity I'm seeing is malicious but can't put this to bed until I'm sure.
I have my DNS servers using two forwarding addresses.
What I'm expecting to see is that the only IP addresses I send external queries to are the two I have configured as forwarding address, OR the Root Hints IP addresses.
Instead I'm seeing occasional requests being sent to other IP addresses.
Why would my DNS server send requests to anything besides my Forwarders or Root Hints?