isc.sans.edu 7/7/2026, 7:07:25 PM · external

Why Obsolete NIMLOC DNS Records Still Show Up in macOS Traffic

Why Obsolete NIMLOC DNS Records Still Show Up in macOS Traffic
CyberSIXT Evidence Panel Source marked as original reporting

THE post discusses NIMLOC (Nimrod Locator) DNS records, which are now considered obsolete and were originally meant for a routing protocol called Nimrod. NIMLOC records are not widely used in modern network operations, and their role has diminished as technology has evolved. The author notes that such records appear in DNS traffic, particularly from macOS systems, linking it to older standards like NetBIOS over TCP/UDP.

A comparison of various DNS resource record types is included, highlighting NIMLOC's historical context alongside other records. The author concludes that modern applications seldom use these records, and the presence of NIMLOC is mainly a legacy issue.

View full article

Article by CyberSIXT