DNS queries to substack and chipsandcheese.com

Installing and Using OpenWrt
1

I've noticed that a fresh build of OpenWRT 24.10 performs a lot of repeated DNS queries for substack.com and chipsandcheese.com (which is something related to substack apparently)

root@OpenWrt:~# tcpdump udp port 53                                                                                                                                                 
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode                                                                                                           
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes       
[.....]
13:49:16.257323 IP6 fdcc:c8ad:55f0:0:8832:642e:5236:2772.62561 > fdcc:c8ad:55f0::1.53: 20674+ AAAA? chipsandcheese.com. (36)                                                        
13:49:16.257350 IP6 fdcc:c8ad:55f0:0:8832:642e:5236:2772.60965 > fdcc:c8ad:55f0::1.53: 23783+ HTTPS? chipsandcheese.com. (36)                                                       
13:49:16.257548 IP6 fdcc:c8ad:55f0:0:8832:642e:5236:2772.57677 > fdcc:c8ad:55f0::1.53: 46009+ A? chipsandcheese.com. (36)                                                           
13:49:16.257584 IP 192.168.0.198.55174 > 192.168.0.6.53: 60841+ AAAA? chipsandcheese.com. (36)                                                                                    
13:49:16.257729 IP 192.168.0.198.55150 > 192.168.0.6.53: 59535+ HTTPS? chipsandcheese.com. (36)                                                                                   
13:49:16.257801 IP 192.168.0.198.47489 > 192.168.0.6.53: 55829+ A? chipsandcheese.com. (36)                                                                                       
13:49:16.368971 IP6 fdcc:c8ad:55f0:0:8832:642e:5236:2772.61900 > fdcc:c8ad:55f0::1.53: 1759+ A? substackcdn.com. (33)                                                               
13:49:16.369266 IP 192.168.0.198.35019 > 192.168.99.6.53: 9209+ A? substackcdn.com. (33)                                                                                           
13:49:16.369692 IP6 fdcc:c8ad:55f0:0:8832:642e:5236:2772.50309 > fdcc:c8ad:55f0::1.53: 27541+ HTTPS? substackcdn.com. (33)                                                          
13:49:16.369826 IP 192.168.0.198.53294 > 192.168.99.6.53: 48282+ HTTPS? substackcdn.com. (33)

and so on. 192.168.0.198 is the IP address of the board.

Can anyone shed some light on why this could be happening? I cannot find any references to either domain in the source tree or package feeds

2

Probably unrelated to OpenWrt at all. I would enable query logging in settings and see who is actually asking for these names.

3

OpenWrt is acting as a DNS cache, those queries come from some device within your network.

4

Thanks to both of you, this makes sense to me!