@CyberHavoc9017 

Hi, Thank you very much for the feedback.

Did you save any screenshots of the excessive DNS requests to Avira subdomains? 

- The previous firmware did fix this issue and I haven't seen similar feedback ever since.

(There was other feedback about excessive DNS requests but it is not only for Avira/HomeShield. The online internet detection of Deco will also need DNS inquiry to some online domains, like amazon.com,reddit.com, etc.)

Wait for your reply and best regards.

  @David-TP 

Thank you for your response.

I did save a screenshot of the excessive DNS requests to Avira subdomains during the last 24 hours.

That's 419 requests an hour. 7 requests a minute.

Despite the firmware update, I haven't noticed a reduction in these requests.

  @CyberHavoc9017 

Hi, Thank you very much for the update

I've checked with the senior engineers and the current DNS frequency is within the reasonable range, which is far from being called the DNS flood.
Ast-dual.safethings.avira.com is used for "Real-Time IoT Protection" under Network Security. To ensure the accuracy of the detection, it is necessary to keep a certain amount of DNS requests.

Thanks again and best regards.

  @David-TP 

I would like to get some clarification regarding certain domains that seem to generate a lot of DNS queries on my network. Specifically, I am blocking the following domains:

• a.root-servers.net
• *.safethings.avira.com
• bing.com
• youtube.com
• www.netflix.com
• reddit.com
• live.com
• *.tplinkcloud.com

My question is: Will blocking these domains negatively affect any essential functions, such as internet connectivity, device security, firmware update or any other TP-Link services? I’m trying to minimize unnecessary DNS queries but want to ensure I’m not breaking anything critical in the process.

Thanks in advance for your assistance!

@David-TP

I would appreciate a solid answer, regarding what kind of data you are sharing with these domains.

To me it seems like the deco firmware is loaded with spyware. However, that might be the case with any products manufactured in China.

Fool me once, shame on you; fool me twice, shame on me.

  @CyberHavoc9017 

Hi, Thank you very much for your time and patience.

• *.safethings.avira.com is used for  "Real-Time IoT Protection" under Network Security.
• *.tplinkcloud.com is to maintain a constant connection on the Deco APP.

For the following DNS domains:

• bing.com
• youtube.com
• www.netflix.com
• reddit.com
• live.com

These domains are meant for the Deco online network detection and Deco didn't share any data with those domains. Blocking those domains would not interfere with the internet access but the LED would turn red due to online detection failure.

If you have further security concerns, It is highly suggested to reach out to security@tp-link.com. The responsible engineers will provide you with more details and offer further assistance.

Thanks a lot and best regards.