Admin Guide › Logs Events › Dns Security Logs

DNS Security Logs

Navigation: Logs & Events → DNS Security Logs

View and filter DNS queries inspected by TOORCE DNS Security. Each event records the client, requested name, query type, DNSSEC result, category, reputation, and the allow/block decision.

Use boolean logic (AND/OR) in the query builder for investigations — for example action = block AND reputation = critical.

Log fields

Column Description
src_ip Client IP that issued the query
domain Requested FQDN
qtype DNS query type (A, AAAA, TXT, …)
response IP Answer address when the query was allowed
dnssec secure, unsigned, bogus, or indeterminate
category Rating / policy category
reputation clean, suspicious, malicious, critical
action allow or block
reason Engine-specific cause (C2, DGA, rate limit, DoH bypass, …)

Allow example

{
  "src_ip": "192.168.1.50",
  "domain": "example.com",
  "qtype": "A",
  "dnssec": "secure",
  "category": "business",
  "reputation": "clean",
  "action": "allow"
}

Block example (malicious)

{
  "src_ip": "192.168.1.55",
  "domain": "bad-domain.example",
  "qtype": "A",
  "dnssec": "unsigned",
  "category": "malware",
  "reputation": "critical",
  "action": "block",
  "reason": "C2 domain"
}

Available actions

Technical background

DNS Security Logs are the audit trail for name-level policy. They complement Firewall Security (connections) and Web Security (URLs). Forward the same stream to a SIEM from System Settings → General → Syslog.

Forensics use

Goal Filter
Compromised host action=block + reason contains C2 / DGA / tunneling
Policy test Search a test domain after changing a category
DNSSEC failures dnssec=bogus
Bypass attempts reason contains DoH or DoT

Related topics