On-premises DNS resolution logs

Procedure

1. Log in to the Alibaba Cloud DNS - Log Service console.

2. In the left-side navigation pane, choose Query Logs > Private Zone > On-premises DNS.

   The page displays the resolution logs for on-premises DNS. You can filter the logs by Resolve Node, time range, and Zone Name. The log table includes fields such as Query Time (UTC+8), Response Time (UTC+8), Resolution Latency (ms), Source IP Address, IP Address Carried in ECS, Zone Name, Query Record Type, and Resolver IP Address. In the upper-right corner, you can click the Syslog Message Push link to configure log forwarding.

3. Set a time range and then click Query to view the resolution logs.

Field descriptions

Query Time (UTC+8): The time when the DNS query was initiated.

Response Time (UTC+8): The time when the DNS response was sent.

Resolution Delay (ms): The time in milliseconds between initiating a DNS query and receiving its response.

Source IP Address: The IP address of the client that initiated the private DNS query, typically an internal server or office workstation.

IP Address Carried in ECS: For local DNS resolvers that support the edns-client-subnet (ECS) protocol, the resolver includes a processed version of the client source IP address in the ECS extension, enabling the authoritative DNS server to provide more accurate scheduling.

Zone Name: The target domain name of the DNS query.

Query Record Types: The type of DNS record requested, such as A, AAAA, CNAME, TXT, or MX.

Query Flag:

Flag name	Description
RD (Recursion Desired)	A client sets this flag in a DNS query to request that the server perform recursive resolution.
CD (Checking Disabled)	Typically appears in response packets. Some older probing tools include this flag in requests, but DNS servers ignore it, so it does not affect query results.

Response Flag:

Flag name	Description
AA (Authoritative Answer)	Indicates that the response is from an authoritative DNS server for the domain. If unset, the response is from a cache or a non-authoritative server.
TC (Truncation)	Indicates that the response was truncated because its size exceeded the transport limit.
RA (Recursion Available)	Indicates that the DNS server supports recursive queries.
AD (Authenticated Data)	Used in DNSSEC environments. This flag indicates that the server has authenticated all data in the response.
RD (Recursion Desired)	When present in a response, this flag mirrors the RD flag from the original query and has no other function.
QR (Query/Response)	A server sets this flag to indicate the packet is a response.

Agreement Type: The protocol used for the DNS query, such as UDP, TCP, or HTTPS.

Resolution Results: The result of the DNS query.

Response Status: Common response statuses include the following:

Status	Description
NOERROR	The server successfully resolved the query.
NXDOMAIN (Non-Existent Domain)	The queried domain name does not exist.
SERVFAIL (Server Failure)	The DNS server could not process the query due to an internal server issue.
REFUSED	The DNS server refused the requested operation for policy reasons, such as denying resolution to the requester or refusing zone transfers.
FORMERR (Format Error)	The DNS server could not interpret the query because of a format error.
NOTIMP (Not Implemented)	The DNS server does not support the requested query type.
Drop	The DNS server dropped the request due to a policy violation, such as receiving a malformed packet.

Important

Your resolution logs may contain entries with an NXRRSET status. In RFC specifications, this status indicates a nonexistent resource record during an update operation. In Alibaba Cloud DNS, NXRRSET means the queried domain name exists but has no record of the queried type. For example, in a dual-stack (IPv4 and IPv6) environment, if only an IPv4 A record is configured for a domain and a client queries for both A and AAAA records, the AAAA query returns NXRRSET while the A query succeeds. An NXRRSET status does not necessarily indicate an error. Verify whether a record of the queried type is configured for the domain.

Resolve Node: The IP address of the authoritative server that answered the DNS query.

Filter queries

Filter by time and cluster

• Filter logs by a specific resolution cluster.

• Query logs from any time range within the last 90 days.

Filter by keyword

You can filter logs by keywords such as Zone Name, Source IP Address, Query Record Types, Response Status, and Resolution Latency.

Syslog Message Push

1. To forward resolution logs to a dedicated log server, click the Syslog Message Push button in the upper-right corner of the page.

2. In the dialog box, turn on the log push switch, select the push protocol and server address, and then click OK. In the dialog box that appears, turn on the Enable Syslog resolution log push switch, set the Syslog Push Protocol (such as UDP), enter the Syslog Server Address (such as 192.168.1.10), and then click OK.