These addresses are announced from every location, and a request is routed to the nearest one. "Answered at" is the location that served this request.

No query is recorded: not the name, not the client address, not a hash of either. The address shown above is taken from this connection and is not stored.

DNSSEC is validated: a name whose signatures do not check out is refused rather than answered.