What can DNS query logs actually show?¶
title: "What can DNS query logs actually show?" card_id: "IP-045" status: "complete" source_document: "https://docs.google.com/document/d/1NqBqzcKX6z1GuKUeRyZlCr6pXYEZ2-mEheVNozOx7bQ/edit?usp=drivesdk"
What can DNS query logs actually show?¶
A DNS query log records part of the process used to obtain information about a domain name.
But not all DNS logs observe the same thing.
A record created on a laptop may identify the local application or device that made the request.
A workplace DNS resolver may see the private IP address of a device on the organisation’s network.
An internet provider or public resolver may see the public address of the connection—or another resolver forwarding the query.
An authoritative DNS server will commonly see the recursive resolver asking the question, rather than the original device.
The observation point is therefore essential.
A DNS log may contain the date and time of the query, the apparent client address and the name being requested.
It may also show the query type.
An A query asks for an IPv4 address. A AAAA query asks for an IPv6 address. Other query types can request mail-server, alias, nameserver or other DNS information.
Some logs record the answer returned.
That might include one or more IP addresses, an alias or an indication that the requested information wasn't available.
A response such as NXDOMAIN normally means that the responding DNS system considered the requested name not to exist.
A failure response may instead indicate a temporary problem, refusal or inability to obtain an answer.
A logged query without a successful answer doesn't establish that the named service was reachable.
Equally, an authoritative server may have no record of a particular user’s query because a recursive resolver answered it from cache.
The apparent client IP address also requires interpretation.
On a local network, it may be a private address that needs to be matched against DHCP, Wi-Fi or device records.
At a public resolver, the address may represent a household, business, mobile connection, VPN or another shared network.
At an authoritative server, it may identify only the recursive resolver.
DNS logs can also be incomplete.
Logging may not have been enabled, records may have expired, some queries may have been sampled or a device may have used encrypted DNS or another resolver that bypassed the system being examined.
A DNS query log may establish that a particular DNS system received a request for information about a name at a recorded time.
If the response is logged, it may also show what information that system returned.
It doesn't automatically prove which application caused the query, which person was using the device or whether any later connection occurred.
The value of a DNS log comes from understanding who could send queries to that system, what the system recorded and where it sat in the DNS process.