If you do run an NTP server, please make sure it's not vulnerable to DDoS amplification (monlist, readvar, etc need to be disabled) and apply some rate limiting to make it less useful for reflection attacks. And be proactive about monitoring its traffic volume.

If you see high packet rate from a specific IP address or prefix, it's very likely not them abusing your service, but rather you attacking them by responding to spoofed requests.

> The pool is currently keeping the time of an estimated 5-15 million systems accurate.

When was this page last updated? I would expect that number to be in the hundreds of millions these days, perhaps even billions.

> The way a vendor embedding NTP is _meant_ to do so is documented here: https://www.ntppool.org/en/vendors.html

Note that in the past I've had companies writing embedded linux based firmware using ntppool for time sync request their own vendor zones, however a lot of those requests were ignored so it's unclear if that's still expected. In the end they ended up just using the default ntppool domains since they never got their own vendor zones.

I remember going through the same thing. No response. This was a long time ago, though.

Yes, they should absolutely be using a vendor zone instead of a CNAME under tesla.com.