All Products
Search

This Product

    Alibaba Cloud DNS:Store Private Zone resolution logs in SLS

    Document Center

    Alibaba Cloud DNS:Store Private Zone resolution logs in SLS

    Last Updated:Sep 07, 2026
    Important

    You can only deliver logs for regions and VPCs where Traffic Analysis is enabled. If the Traffic Analysis service is disabled, the log delivery service will have no log data. For more information, see Enable or disable traffic analysis.

    Use cases

    Compliance and security policies often require storing and analyzing network logs. Private zone resolution logs record private domain name usage in your network, enabling user activity audits and security risk detection.

    What is Private zone resolution logs

    A private zone resolution log records DNS queries and responses from all VPCs under an Alibaba Cloud account. Each entry captures the region, VPC ID, source and destination IP addresses, queried domain name, record type, and response. Queried domains include both authoritative private domains in PrivateZone and external public domains. For multi-account and multi-region scenarios, Alibaba Cloud DNS and SLS provide one-click private DNS logging through the Log Audit application.

    Queried domain names fall into four categories:

    1. Built-in authoritative zone

    PrivateZone maps private domain names to IP addresses within one or more VPCs. Use these domain names to access Alibaba Cloud resources such as ECS instances, SLB instances, and OSS buckets. These domains are accessible only within the VPC. You can also connect a VPC to a data center via a leased line or VPN for bidirectional private domain name resolution.

    2. Cloud product instance domains (Apsara Cloud DNS)

    A foundational DNS service built into the Apsara platform that resolves instance domain names of all Alibaba Cloud products.

    3. Forwarding external domains to external DNS

    An external DNS is typically your data center's internal DNS. The forwarding management feature routes DNS queries from a VPC to this system, enabling ECS instances in an Alibaba Cloud VPC to resolve application domains in your data center.

    4. Public domain recursion to external DNS

    A public authoritative DNS server manages DNS records for a specific public domain (such as "example.com") at a domain name registry or domain name registrar. It resolves only the domain names it serves and rejects all other queries.

    Configure delivery in the DNS console

    This entry is available only to accounts on the allowlist. If your account is not on the allowlist, contact your Alibaba Cloud account manager or submit a ticket to request access.

    1. Log on to the Alibaba Cloud DNS - Private Zone console.

    2. Turn on the Private Zone Traffic Analysis toggle in the upper-right corner. If it is already enabled, click the Settings button next to the toggle.

    3. Configure the following parameters:

      Parameter

      Description

      Regions

      The region in which to enable traffic analysis.

      VPCs

      The VPCs for which to enable traffic analysis. Leave empty to enable for all VPCs in the selected region.

      Location of Traffic Analysis Server

      The region of the log analysis servers. System-configured and cannot be changed.

      Log Storage and Analysis

      Select one of the following:

      • Delivery: Logs are delivered directly to SLS without storage or analysis in Private Zone.

      • Analysis & Delivery: Private Zone stores and analyzes logs, and delivers a copy to SLS.

      Delivery Configuration

      • Region: The region for log storage.

      • SLS Project: Create or select an existing project.

      • Logstore: Create or select an existing logstore.

    4. Click OK to save the configuration.

    View Private Zone resolution logs in SLS

    1. Log on to the SLS console.

    2. Open the Project that you selected in Delivery Configuration, and then open the selected Logstore.

    3. View the delivered resolution logs in the Logstore.

    Private zone resolution log fields

    1. Request log example

    Parameter

    Description

    Example

    dns_msg_flags

    DNS message flags:

    • RD: Recursion Desired. Indicates a request for a recursive query.

    • AD: Authentic Data. This flag is not typically included in request messages and has no effect if present.

    • CD: Checking Disabled. Instructs the responding server to provide a response regardless of whether DNSSEC validation passes.

    RD

    dns_msg_id

    The unique identifier for the DNS message.

    30914

    dst_addr

    The destination IP address.

    100.100.2.136

    dst_port

    The destination port.

    53

    ecs_hostname

    The ECS hostname.

    iZbp1b1mx9fhe34k*****

    ecs_id

    The ECS instance ID.

    i-bp1b1mx9fhe34kh****

    module_type

    The log module type. For request logs, the only valid value is GLOBAL.

    • GLOBAL: Global

    GLOBAL

    query_name

    The domain name being queried.

    www.example.com.

    query_type

    The requested record type, such as A, AAAA, CNAME, TXT, or MX.

    A

    region_id

    The region ID.

    cn-shanghai

    src_addr

    The source IP address.

    192.168.0.1

    src_port

    The source port.

    42071

    transport

    The transport protocol.

    UDP

    user_id

    The Alibaba Cloud account ID.

    139749398683****

    vpc_id

    The VPC ID.

    vpc-bp1eyy43516itw78****

    edns

    Information about the Extension Mechanisms for DNS (EDNS). This field can appear in both query and response logs.

    "flags: DO udp: 1408 CLIENT-SUBNET: 1.1.XX.XX/32/24"

    2. Global response log

    Log field

    Description

    Example

    answer_rrset

    The answer resource record set.

    JSON array:

    ["www.example.com. 600 A 192.168.1.1", "www.example.com 600 A 192.168.1.2"]

    authority_rrset

    The authority resource record set.

    JSON array:

    ["example.com. 600 SOA ns1.example.com. hostmaster.example.com. 2023010101 3600 1200 3600 360" ]

    additional_rrset

    The additional resource record set.

    JSON array:

    ["ns1.example.com. 600 A 100.100.2.136"]

    dns_msg_flags

    • QR (Query Response): Indicates a response message from a server.

    • RD (Recursion Desired): Indicates that the client requests a recursive query.

    • AA (Authoritative Answer): Indicates that the response is from an authoritative server.

    • TC (Truncation): Indicates that the server truncated the message.

    • AD (Authentic Data): Indicates that the resolver validated the DNSSEC digital signature.

    • CD (Checking Disabled): Indicates that the responding server must provide a response regardless of whether DNSSEC validation passes.

    QR

    dns_msg_id

    The unique ID for the DNS query.

    30914

    dst_addr

    The destination IP address.

    192.168.0.1

    dst_port

    The destination port.

    42071

    ecs_hostname

    The ECS hostname.

    iZbp1b1mx9fhe34k*****

    ecs_id

    The ECS instance ID.

    i-bp1b1mx9fhe34kh****

    module_type

    The type of the module that generated the log.

    • GLOBAL: The global module.

    GLOBAL

    query_name

    The queried domain name.

    www.example.com.

    query_type

    The record type of the query, such as A, AAAA, CNAME, TXT, or MX.

    A

    rcode

    The response code.

    • 0 (NOERROR): The query was successful.

    • 1 (FORMERR): The DNS server could not process the query due to a format error.

    • 2 (SERVFAIL): The DNS server failed to resolve the domain name due to an internal error or timeout.

    • 3 (NXDOMAIN): The queried domain name does not exist.

    • 4 (NOTIMP): The server does not support the requested operation.

    • 5 (REFUSED): The DNS server refuses to respond for policy or security reasons.

    0

    region_id

    The region ID.

    cn-shanghai

    resolve_path

    This field appears only in global response logs. The comma-separated values represent the following modules in order: authoritative accelerated zone, authoritative standard zone, cache module, forwarding module, and recursion module.

    1: Indicates that the query passed through the module.

    0: Indicates that the query skipped the module.

    For multi-level CNAME resolutions, multiple modules can have a value of 1.

    1,0,0,0,0

    rt

    The response latency.

    • In global response logs, rt represents the total latency from query to response.

    • In module logs, rt represents the latency incurred within the module.

    10 ms

    src_addr

    The source IP address.

    100.100.2.136

    src_port

    The source port.

    53

    transport

    The transport protocol.

    UDP

    user_id

    The Alibaba Cloud account ID.

    139749398683****

    vpc_id

    The VPC ID.

    vpc-bp1eyy43516itw78****

    edns

    Extension Mechanisms for DNS (EDNS). This field can appear in query or response logs.

    "flags: DO udp: 1408 CLIENT-SUBNET: 1.1.XX.XX/32/24"

    3. Module response log example

    Log field

    Description

    Sample data

    answer_rrset

    The answer resource record set.

    JSON array:

    ["www.example.com. 600 A 192.168.1.1", "www.example.com 600 A 192.168.1.2", ]

    authority_rrset

    The authority resource record set.

    JSON array:

    ["example.com. 600 SOA ns1.example.com. hostmaster.example.com. 2023010101 3600 1200 3600 360" ]

    additional_rrset

    The additional resource record set.

    JSON array:

    ["ns1.example.com. 600 A 100.100.2.136"]

    dns_msg_id

    The DNS message ID, a unique identifier for the DNS query.

    30914

    dst_addr

    The destination IP address.

    100.100.2.136

    dst_port

    The destination port.

    53

    ecs_hostname

    The ECS hostname.

    iZbp1b1mx9fhe34k*****

    ecs_id

    The ECS instance ID.

    i-bp1b1mx9fhe34kh****

    module_type

    The module that generated the log:

    • AUTH_FAST: The authoritative fast zone.

    • AUTH_SLOW: The authoritative normal zone.

    • FORWARD: The forwarding module.

    • CACHE: The cache module.

    • RECURSION: The recursion module.

    AUTH_FAST

    query_name

    The queried domain name.

    www.example.com.

    query_type

    The query type, such as A, AAAA, CNAME, TXT, or MX.

    A

    rcode

    The response code:

    • 0 (NOERROR): The query was successful.

    • 1 (FORMERR): The DNS server could not process the query due to a format error.

    • 2 (SERVFAIL): The DNS server failed to resolve the domain name due to an internal error or timeout.

    • 3 (NXDOMAIN): The domain name was not found.

    • 4 (NOTIMP): The server does not support the specified operation code.

    • 5 (REFUSED): The DNS server refused to respond for policy or security reasons.

    0

    region_id

    The region ID.

    cn-shanghai

    rt

    The response latency:

    • For global response logs, rt is the total latency from query to response.

    • For module logs, rt is the latency incurred within the module.

    1ms

    src_addr

    The source IP address.

    192.168.0.1

    src_port

    The source port.

    42071

    transport

    The transport protocol.

    UDP

    user_id

    The Alibaba Cloud account ID.

    139749398683****

    vpc_id

    The VPC instance ID.

    vpc-bp1eyy43516itw78****

    edns

    Extension Mechanisms for DNS (EDNS). This field may appear in query or response logs.

    "flags: DO udp: 1408 CLIENT-SUBNET: 1.1.XX.XX/32/24"

    Log analysis

    The following are common Private Zone log query scenarios. You can also write custom SQL, add results to dashboards, save as quick queries, or create alerts.

    1. DNS resolution result types

    Distribution of DNS requests across domain names within a specified VPC over a specific period.

    * and vpc_id: vpc-2ze9dducyc3t6p8aeksb3 |select count(*) as total_req, query_name group by query_name

    After running the query, a pie chart on the chart tab displays the distribution of requests by domain name.

    2. DNS resolution response time

    Analyzes DNS resolution response time for a specific VPC, domain name, and query type.

    * and vpc_id: vpc-2ze9dducyc3t6p8aeksb3 and query_name: "metrichub-cn-beijing.aliyun.com." and query_type: A | select stddev(__time__) as RT, dns_msg_id GROUP by dns_msg_id

    The query returns 100 records in a table with two columns: RT and dns_msg_id. The RT value for all records is 0.0, indicating that the standard deviation of time is 0 for each dns_msg_id group.

    3. Resolution exceptions

    An ECS instance on Alibaba Cloud has resolution issues when querying a domain. The customer enables the private zone resolution log and stores these logs in SLS to analyze the cause. The SLS log can include the following three types: request log, global response log, and module response log.

    Analysis process:

    1. Use the src_port and dns_msg_id parameters to identify and filter log entries for a single resolution request.

    2. The following fields distinguish the three log types:

      1. A log is a request log if the rt field is empty.

      2. A log is a module response log if the resolve_path field is empty.

      3. A log is a global response log if the resolve_path field is not empty.

    3. Error result example

      Based on the preceding rules, the first entry is a request log, the second is a module response log, and the third is a global response log.

      The dns_msg_id for all three log entries is 59241. In the first log, module_type is GLOBAL and dns_msg_flags is RD. In the second log, module_type is RECURSION and dns_msg_flags is empty. In the third log, module_type is GLOBAL, dns_msg_flags is QR RD, and dst_addr is 100.100.2.136.

      1. A client initiates a DNS resolution request, expecting a recursive query.

      2. The request is sent to the recursive module, but the resolution fails.

      3. The server at 100.100.2.136 returns an error to the client.

    4. Successful result example

      In successful DNS intranet log query results, typical key fields and values include: _source_ is log_dispatch, _topic_ is dns_intranet_log, module_type is GLOBAL or CACHE, query_type is A, dst_addr is 100.100.2.136, dst_port is 53, transport is UDP, answer_rset contains CNAME resolution records, and node_id is cn-shanghai.

      1. A client initiates a DNS resolution request, expecting a recursive query.

      2. The request is sent to the recursive module, and the resolution succeeds.

      3. The server at 100.100.2.136 returns the resolution result to the client.