@hanno @TimPhSchaefers this is pretty common. In my former life I discovered that an AD used internally a not-yet-claimed domain. I did that then for pentesting which was scary and funny at the same time. I gave the domain back 5 years after everything was switched to a really internal domain and _no_ DNS-requests came to me for 2 years ;) so, this is quite... usual.