Admin Guide › Dns Security › Dns Logging

DNS Logging

Navigation: DNS Security → DNS Logging

Every inspected query can be written to DNS Security Logs with enough context for incident response and SIEM correlation: who asked, what name, which type, whether DNSSEC held, how the name was categorized, and why it was allowed or blocked.

Log fields

Field Description Example
src_ip Client that sent the query 192.168.1.50
domain Requested FQDN example.com
qtype Query type A, AAAA, TXT, MX
dnssec Validation result secure, unsigned, bogus
category Policy / rating category business, malware
reputation Cache / intel verdict clean, critical
action Decision allow, block
reason Why (on block or notable allow) C2 domain
response IP Answer address when present 93.184.216.34

The same records appear under Logs & Events → DNS Security Logs. Forward them with other firewall logs via Syslog if you use a SIEM.

Allow example

{
  "src_ip": "192.168.1.50",
  "domain": "example.com",
  "qtype": "A",
  "dnssec": "secure",
  "category": "business",
  "reputation": "clean",
  "action": "allow"
}

Block example (malicious)

{
  "src_ip": "192.168.1.55",
  "domain": "bad-domain.example",
  "qtype": "A",
  "dnssec": "unsigned",
  "category": "malware",
  "reputation": "critical",
  "action": "block",
  "reason": "C2 domain"
}

Other useful reasons

reason Engine
C2 domain / phishing / ransomware Threat Intelligence
Category policy DNS Filtering
DNS tunneling pattern Anti-Tunneling
DGA domain Anti-DGA
Query flood / rate limit Anomaly Protection
DNSSEC bogus DNSSEC Validation
Unauthorized DoH resolver DoH/DoT Control

What to watch

Question How to use the log
Which host talks to C2? Filter action=block and reputation=critical
Is DNSSEC working? Count dnssec=secure vs bogus
Who is tunneling? Filter tunneling / TXT / high-entropy reasons
Are users hitting DoH? Filter DoH/DoT block reasons
Did a new allow-list work? Search domain and confirm action=allow

Retention and forwarding

Related topics