NXDOMAIN
The resolver answered, and the answer was that the name does not exist. That is a working DNS server giving a correct reply, which is why it is worth reading carefully.
What it looks like
A query, and a response with rcode 3. The report lists it under DNS and, when there are many, raises a finding about the pattern rather than the individual lookups.
One is a typo. A hundred is a pattern.
- A search domain appended to everything. A misconfigured
searchline makes every lookup fail once or twice before succeeding. Harmless, wasteful, and very common. - A decommissioned service. Clients still asking for a name nobody publishes any more.
- Names that look random. A domain-generation algorithm: malware working through generated names until one resolves. If the failures are random strings rather than plausible hostnames, that is what this is, and the host asking is the problem.
- Many different names under one domain, nearly all failing. A random-subdomain flood, aimed at whoever is authoritative for that domain and laundered through your resolver.
What to do
Look at the shape of the names, not the count. Mistyped, truncated or suffixed names are a configuration problem and belong to whoever owns the client. Random-looking names belong to whoever owns the host, and that host should be treated as compromised until somebody can name the process making the lookups.