Observation Encodings

Observations sent out from DNS TAPIR Core are packed in a 32-bit word with the following interpretations:

Encoding	Observation	Interpretation
1	GLOBALLY_NEW	Previously unseen by any Edge
2	TODO	TODO
4	NEWLY_REGISTERED	Domain was created very recently
8	REGISTRY_INVESTIGATION	Domain is under investigation by its registry
16	TODO	TODO
32	TODO	TODO
64	TODO	TODO
128	TODO	TODO
256	TODO	TODO
512	TODO	TODO
1024	LOOPTEST	Observation for testing use only
others	TODO	TODO

Detailed Explanations

GLOBALLY_NEW

This observation flag is set for a domain the first time any Edge resolver in a DNS TAPIR system receives a query for it. It is set regardless of what the response was. For example, it will be set even for NXDOMAIN and NODATA responses.

Some domains will not cause a corresponding GLOBALLY_NEW observation to be sent out. Those are the so-called "well-known" domains that are configured as part of installing a DNS TAPIR Edge system. For those domains, only aggregated statistics such as counters will be collected.

NEWLY_REGISTERED

This observation flag is set for a domain if it was newly registered when it was first seen by an Edge resolver. I.e. when the domain is no older than one week when an Edge resolver first encountered it.

REGISTRY_INVESTIGATION

This observation flag is set for a domain if it under investigation by its registry for some reason. A registry can launch an investigation into a domain for numerous reasons. For example, the registry might be trying to verify registrant data for a domain, a domain might be involved in a legal dispute or there has been complaints about a domain being involved in some kind of abuse.

LOOPTEST

This observation flag is set for domains that are used for testing purposes. More documentation on how a looptest can be conducted can be found here.