Public Zone logs

Overview

Use the detailed resolution logs in DNS Traffic Analytics to troubleshoot DNS scheduling accuracy for endpoints such as PCs and phones. These logs show each request's source IP, helping identify scheduling issues by IP region and ISP.

Note

This feature requires DNS Traffic Analytics. Enable, disable, or configure DNS traffic analysis.

View logs

Go to the Alibaba Cloud DNS - Log Service page.
By default, the Query Logs > Public Zone page opens by default. In the left navigation pane, select Public DNS. On the Resolution Log tab, set filters such as time range and domain name, then click Search.

Column descriptions

Resolution response time: The time when the authoritative DNS server responded.

Resolution latency: The time the authoritative DNS server took to process the query. This excludes end-to-end latency from the client endpoint.

Source IP address: The egress IP address of the resolver that queried the authoritative DNS server, typically the ISP's local recursive DNS.

ECS extension IP: When the local recursive DNS supports EDNS Client Subnet (ECS), it passes a partially anonymized client IP in the query, enabling more accurate intelligent scheduling based on the client's actual network location.

For example, consider an ECS value of 223.5.5.XX/25/24:

The /25 mask means the local recursive DNS sends the first 25 bits of the client IP to the authoritative server, preserving privacy. The server uses 223.5.5.XX/25 for intelligent scheduling.
The /24 mask in the response defines the cacheable client IP range. Subsequent queries for the same domain from any client in the 223.5.5.XX/24 subnet can use the local recursive DNS cache.

Important

If a local recursive DNS does not support the ECS protocol, Alibaba Cloud DNS performs intelligent scheduling based on the source IP address.
If a local recursive DNS supports the ECS protocol, Alibaba Cloud DNS performs more accurate intelligent scheduling based on the ECS extension IP.

Queried domain name: The target domain name of the DNS query.

Record type: The type of DNS record, such as A, AAAA, CNAME, TXT, or MX.

Resolution result: The result of the domain name resolution.

Response status: The status of the response. Common statuses include:

Status	Description
NOERROR	The query was successfully resolved.
NXDOMAIN (Non-Existent Domain)	The queried domain name does not exist.
SERVFAIL (Server Failure)	The authoritative DNS server could not process the query due to an internal issue.
REFUSED	The DNS server refused the query based on policy, such as unauthorized requester or restricted operations like zone transfers.
FormErr (Format Error)	The DNS server could not interpret the query.
NotImp (Not Implemented)	The DNS server does not support the requested query type.
Drop	The DNS server dropped the request due to policy, for example, for a malformed packet.

Important

In Alibaba Cloud DNS Traffic Analytics, NXRRSET means the queried domain exists but has no records of the requested type — unlike the RFC definition where NXRRSET indicates a missing resource record during updates. For example, if only an IPv4 A record is configured, queries for AAAA records return NXRRSET while A record queries succeed. An NXRRSET status does not necessarily indicate an error — verify that a record of the queried type is configured.

Authoritative server IP: The IP address of the authoritative DNS server that provided the response.

Filter queries

Filter by time

Logs are retained for 90 days.

Filter by keyword

Filter by Queried domain name, Source IP address, Resolution result, Authoritative server IP, Response status, or Record type.