Bananas has to run dns severs here in the zoo for reasons that most dns hosters don’t do this (my blog) when we did it. In fact i moved registrar on account of no dnssec in dns and broken dnssec configuration in the domain management.
So one day i turned on monitoring and saw probes like:
client 22.214.171.124#48121 (dnsscan.shadowserver.org): query
(cache) 'dnsscan.shadowserver.org/A/IN' denied
So there is a bit of a pattern emerging and while shit does happen i see little point in testing the same bloody thing over and over again. I blocked them for being idiots.