Does a DNS query prove that somebody visited a website?¶
title: "Does a DNS query prove that somebody visited a website?" card_id: "IP-044" status: "complete" source_document: "https://docs.google.com/document/d/1buY-_rRWsREY4cG7eyN2amg4SdAnb0ijLzIfM5gxb0A/edit?usp=drivesdk"
Does a DNS query prove that somebody visited a website?¶
A DNS log shows that a device or network requested information about a particular domain name.
Does that prove somebody visited the website?
No—not by itself.
The query establishes that something caused DNS information about the name to be requested.
That may have happened because a person entered the address into a browser or clicked a link.
But there are many other possibilities.
Browsers can look up names in advance so that a possible future connection happens more quickly. This is sometimes called DNS prefetching.
A webpage can also cause lookups for advertising, analytics, images, fonts and other services without the user deliberately selecting those domains.
Applications regularly perform background lookups. Email clients may process links or load remote content. Security software may check suspicious domains, and automated link scanners may inspect addresses contained in messages.
The operating system itself can generate DNS queries while testing connectivity or contacting update and cloud services.
A DNS query also occurs before a connection to the destination is normally attempted.
The connection may fail, be blocked or never take place. Even if it succeeds, the query doesn't show which page was requested, what content was displayed or what the user did.
The record may not identify the original device either.
An authoritative DNS server will often see the query arriving from a recursive resolver. Many customers may use that resolver, so its IP address doesn't necessarily identify the person or device that caused the lookup.
A local or enterprise resolver log may contain more useful client information, but that still needs to be interpreted in the context of the network and its address-allocation records.
The absence of a DNS query doesn't prove that a website wasn't visited.
The answer may already have been cached. The device may have used a different resolver, encrypted DNS, a VPN, a locally configured address or a direct IP connection.
A DNS query becomes more useful when it can be combined with other evidence.
A network connection to an address associated with the domain at the same time, browser history, cached content, an SNI value, proxy records, account activity or server-access logs may help show what followed the lookup.
The timing and source of the DNS record must also be established accurately.
A DNS query can support the conclusion that a device or network sought information about a domain.
It doesn't, without corroboration, prove that a particular person visited the website or viewed any of its content.