@natalie

> what are the source addresses like? just a few?

Present in the iftop screenshot. I can pull all of them out if it's of interest. It's still going on right now.

> asking mgi.gov's nameservers for ANY gives a pretty big response with a bunch of dnssec rrsig so that's probably why that name in particular...

*Ah*. The queries are ANY.