Why it exists
Private-IP reverse DNS leaks, and AS112 stops them at the exchange
End-user devices, hypervisors, containers and middleboxes constantly fire reverse DNS queries for private ranges: 10.0.0.1, 192.168.1.254, 169.254.x.y. Without a local sink, each query travels up the DNS hierarchy to the root servers, which see them as garbage traffic.
AS112 is the IETF-standardised answer. A distributed anycast responder returns an authoritative NXDOMAIN for those zones, immediately and locally. At DSIX we run a compliant node so every peer's resolver gets the answer in microseconds over the peering fabric, not hundreds of milliseconds from the global root.
Deploying at an IX is the recommended operational model under RFC 7534; the DSIX node also implements the empty-zone DNAME redirection of RFC 7535.
Prefixes handled
10.0.0.0/8Private Class A • RFC 1918172.16.0.0/12Private Class B • RFC 1918192.168.0.0/16Private Class C • RFC 1918169.254.0.0/16Link-local • RFC 3927Peer with us
AS112 Peering Addresses
Configure a BGP session against these addresses, or rely on the DSIX route servers to push the AS112 prefixes automatically.
Best practice: peer bilaterally for direct performance, and keep the route-server session as a fallback. Maintain a permissive import filter accepting AS 112's four anycast prefixes, no others. For questions or maintenance windows contact noc@dreamserver.ro.
Frequently Asked Questions
Everything operators ask before turning on the service.
What is AS112?
AS112 is a globally standardized anycast service for reverse DNS queries of private (RFC 1918) and link-local IP ranges. It returns authoritative null responses for 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 169.254.0.0/16, preventing those queries from propagating onto the public internet where they cause load on root name servers and slow down operating system calls.
Why do I need AS112 on my network?
Even well-configured networks leak reverse DNS queries for private IPs. Without a local AS112 sink, those queries travel upstream to root and TLD servers, creating unnecessary traffic, hitting rate limits, and occasionally freezing applications that are waiting for a resolver answer. Peering with AS112 at DSIX makes the response instant and local.
Is the AS112 service free?
Yes, absolutely. AS112 is included at no cost with your DSIX membership. You only need to establish a BGP session with the AS112 node to start receiving service.
What RFCs does DSIX AS112 implement?
Our AS112 node is fully compliant with RFC 7534 (AS112 nameserver operations) and RFC 7535 (DNAME redirection of the empty zones), the two current IETF standards for the service. It also implements the pre-RFC convention of AS 112 for historical compatibility.
What hardware and software runs the AS112 node?
The DSIX AS112 node runs BIND 9 on Ubuntu 24.04 LTS, deployed on our own infrastructure in Bucharest, Romania. It is dual-stack (IPv4 and IPv6) and peers on the DSIX LAN1 fabric.
How do I establish a BGP session with AS112?
Configure your router to peer with 185.0.0.252 for IPv4 and 2001:7f8:133::112 for IPv6, both in AS 112. The node peers bilaterally with members and is also present on the DSIX route servers, so many members pick it up automatically through route-server policy.
Will AS112 ever announce my prefixes or forward traffic?
No. AS112 only announces the four anycast service prefixes for its own zones. It does not accept inbound prefix announcements from peers and never forwards data-plane traffic. It is a responder-only node.
How do I verify AS112 is working correctly?
Run a dig query for a private IP reverse record, e.g. dig -x 10.0.0.1 @your-router. If AS112 is working, you will get an SOA/NXDOMAIN response from prisoner.iana.org, blackhole-1 or blackhole-2, with sub-millisecond latency when queried through DSIX. A normal resolver without AS112 would take 100-500ms to return the same NXDOMAIN.
Can I run my own AS112 node and announce the same prefixes?
Yes. AS112 is explicitly designed to be anycasted by many operators worldwide. Running your own node complements rather than conflicts with the DSIX node. Check RFC 7534 for the authoritative operational guide.
What happens if AS112 is down?
Queries fall back to root name servers and eventually return NXDOMAIN through the normal DNS hierarchy, just slower. Service outages on AS112 therefore degrade rather than break reverse DNS on private ranges. DSIX monitors the node 24/7 and applies standard DSIX maintenance windows for any planned work.
Does AS112 affect my firewall policy?
Only at BGP level: you accept the four reverse-DNS prefixes from AS 112 (or via the DSIX route servers). No special dataplane firewall changes are required because traffic is standard DNS on UDP/TCP port 53.
Who do I contact if I have AS112 problems?
Reach out to noc@dreamserver.ro for operational issues, or open a ticket through the Client Area. For deep technical discussion about AS112 in general, the IETF DNSOP list is the global forum.
