i'm looking for cases where dns has been modified on a machine in

/etc/resolv.conf

and does not match any RFC1918 address