Alibaba Cloud DNS:Store Private Zone resolution logs in SLS

Use cases

Compliance and security policies often require storing and analyzing network logs. Private zone resolution logs record private domain name usage in your network, enabling user activity audits and security risk detection.

Private zone resolution logs

A private zone resolution log records DNS queries and responses from all VPCs under an Alibaba Cloud account. Each entry captures the region, VPC ID, source and destination IP addresses, queried domain name, record type, and response. Queried domains include both authoritative private domains in PrivateZone and external public domains. For multi-account and multi-region scenarios, Alibaba Cloud DNS and SLS provide one-click private DNS logging through the Log Audit application.

Queried domain names fall into four categories:

1. Built-in authoritative zone

PrivateZone maps private domain names to IP addresses within one or more VPCs. Use these domain names to access Alibaba Cloud resources such as ECS instances, SLB instances, and OSS buckets. These domains are accessible only within the VPC. You can also connect a VPC to a data center via a leased line or VPN for bidirectional private domain name resolution.

2. Cloud product instance domains (Apsara Cloud DNS)

A foundational DNS service built into the Apsara platform that resolves instance domain names of all Alibaba Cloud products.

3. Forwarding external domains to external DNS

An external DNS is typically your data center's internal DNS. The forwarding management feature routes DNS queries from a VPC to this system, enabling ECS instances in an Alibaba Cloud VPC to resolve application domains in your data center.

4. Public domain recursion to external DNS

A public authoritative DNS server manages DNS records for a specific public domain (such as "example.com") at a domain name registry or domain name registrar. It resolves only the domain names it serves and rejects all other queries.

Private zone resolution log fields

1. Request log example

Parameter	Description	Example
dns_msg_flags	DNS message flags: RD: Recursion Desired. Indicates a request for a recursive query. AD: Authentic Data. This flag is not typically included in request messages and has no effect if present. CD: Checking Disabled. Instructs the responding server to provide a response regardless of whether DNSSEC validation passes.	RD
dns_msg_id	The unique identifier for the DNS message.	30914
dst_addr	The destination IP address.	100.100.2.136
dst_port	The destination port.	53
ecs_hostname	The ECS hostname.	iZbp1b1mx9fhe34k*****
ecs_id	The ECS instance ID.	i-bp1b1mx9fhe34kh****
module_type	The log module type. For request logs, the only valid value is GLOBAL. GLOBAL: Global	GLOBAL
query_name	The domain name being queried.	www.example.com.
query_type	The requested record type, such as A, AAAA, CNAME, TXT, or MX.	A
region_id	The region ID.	cn-shanghai
src_addr	The source IP address.	192.168.0.1
src_port	The source port.	42071
transport	The transport protocol.	UDP
user_id	The Alibaba Cloud account ID.	139749398683****
vpc_id	The VPC ID.	vpc-bp1eyy43516itw78****
edns	Information about the Extension Mechanisms for DNS (EDNS). This field can appear in both query and response logs.	"flags: DO udp: 1408 CLIENT-SUBNET: 1.1.XX.XX/32/24"

2. Global response log

Log field	Description	Example
answer_rrset	The answer resource record set.	JSON array: ["www.example.com. 600 A 192.168.1.1", "www.example.com 600 A 192.168.1.2"]
authority_rrset	The authority resource record set.	JSON array: ["example.com. 600 SOA ns1.example.com. hostmaster.example.com. 2023010101 3600 1200 3600 360" ]
additional_rrset	The additional resource record set.	JSON array: ["ns1.example.com. 600 A 100.100.2.136"]
dns_msg_flags	QR (Query Response): Indicates a response message from a server. RD (Recursion Desired): Indicates that the client requests a recursive query. AA (Authoritative Answer): Indicates that the response is from an authoritative server. TC (Truncation): Indicates that the server truncated the message. AD (Authentic Data): Indicates that the resolver validated the DNSSEC digital signature. CD (Checking Disabled): Indicates that the responding server must provide a response regardless of whether DNSSEC validation passes.	QR
dns_msg_id	The unique ID for the DNS query.	30914
dst_addr	The destination IP address.	192.168.0.1
dst_port	The destination port.	42071
ecs_hostname	The ECS hostname.	iZbp1b1mx9fhe34k*****
ecs_id	The ECS instance ID.	i-bp1b1mx9fhe34kh****
module_type	The type of the module that generated the log. GLOBAL: The global module.	GLOBAL
query_name	The queried domain name.	www.example.com.
query_type	The record type of the query, such as A, AAAA, CNAME, TXT, or MX.	A
rcode	The response code. 0 (NOERROR): The query was successful. 1 (FORMERR): The DNS server could not process the query due to a format error. 2 (SERVFAIL): The DNS server failed to resolve the domain name due to an internal error or timeout. 3 (NXDOMAIN): The queried domain name does not exist. 4 (NOTIMP): The server does not support the requested operation. 5 (REFUSED): The DNS server refuses to respond for policy or security reasons.	0
region_id	The region ID.	cn-shanghai
resolve_path	This field appears only in global response logs. The comma-separated values represent the following modules in order: authoritative accelerated zone, authoritative standard zone, cache module, forwarding module, and recursion module. 1: Indicates that the query passed through the module. 0: Indicates that the query skipped the module. For multi-level CNAME resolutions, multiple modules can have a value of 1.	1,0,0,0,0
rt	The response latency. In global response logs, rt represents the total latency from query to response. In module logs, rt represents the latency incurred within the module.	10 ms
src_addr	The source IP address.	100.100.2.136
src_port	The source port.	53
transport	The transport protocol.	UDP
user_id	The Alibaba Cloud account ID.	139749398683****
vpc_id	The VPC ID.	vpc-bp1eyy43516itw78****
edns	Extension Mechanisms for DNS (EDNS). This field can appear in query or response logs.	"flags: DO udp: 1408 CLIENT-SUBNET: 1.1.XX.XX/32/24"

3. Module response log example

Log field	Description	Sample data
answer_rrset	The answer resource record set.	JSON array: ["www.example.com. 600 A 192.168.1.1", "www.example.com 600 A 192.168.1.2", ]
authority_rrset	The authority resource record set.	JSON array: ["example.com. 600 SOA ns1.example.com. hostmaster.example.com. 2023010101 3600 1200 3600 360" ]
additional_rrset	The additional resource record set.	JSON array: ["ns1.example.com. 600 A 100.100.2.136"]
dns_msg_id	The DNS message ID, a unique identifier for the DNS query.	30914
dst_addr	The destination IP address.	100.100.2.136
dst_port	The destination port.	53
ecs_hostname	The ECS hostname.	iZbp1b1mx9fhe34k*****
ecs_id	The ECS instance ID.	i-bp1b1mx9fhe34kh****
module_type	The module that generated the log: AUTH_FAST: The authoritative fast zone. AUTH_SLOW: The authoritative normal zone. FORWARD: The forwarding module. CACHE: The cache module. RECURSION: The recursion module.	AUTH_FAST
query_name	The queried domain name.	www.example.com.
query_type	The query type, such as A, AAAA, CNAME, TXT, or MX.	A
rcode	The response code: 0 (NOERROR): The query was successful. 1 (FORMERR): The DNS server could not process the query due to a format error. 2 (SERVFAIL): The DNS server failed to resolve the domain name due to an internal error or timeout. 3 (NXDOMAIN): The domain name was not found. 4 (NOTIMP): The server does not support the specified operation code. 5 (REFUSED): The DNS server refused to respond for policy or security reasons.	0
region_id	The region ID.	cn-shanghai
rt	The response latency: For global response logs, rt is the total latency from query to response. For module logs, rt is the latency incurred within the module.	1ms
src_addr	The source IP address.	192.168.0.1
src_port	The source port.	42071
transport	The transport protocol.	UDP
user_id	The Alibaba Cloud account ID.	139749398683****
vpc_id	The VPC instance ID.	vpc-bp1eyy43516itw78****
edns	Extension Mechanisms for DNS (EDNS). This field may appear in query or response logs.	"flags: DO udp: 1408 CLIENT-SUBNET: 1.1.XX.XX/32/24"

PrivateZone log audit

1. Audit log

Log Audit Service is an application on the Log Service SLS platform that extends it with multi-account management and cross-region log collection from various Alibaba Cloud products. Use Resource Directory to centrally manage logs across multiple accounts.

2. Enable private zone audit

1. Log in to the Log Audit application console.

2. On the Global Settings page, enable log auditing for Private Zone and select a Central Project region, such as China (Hangzhou). Enable log collection.

3. Other features

Multi-account configuration

ActionTrail consolidates internal DNS logs from member accounts into a single management account through cross-account collection. Two configurations are supported:

• Management mode with Resource Directory

• Management mode with custom authentication

Collect multi-account cloud product logs.

Terraform configuration

Terraform is an open-source tool that uses its command-line interface (CLI) to deploy and manage infrastructure on Alibaba Cloud and other supported clouds via version-controlled configuration files. To configure ActionTrail log collection with Terraform, follow Use Terraform to configure ActionTrail.

The following example shows how to configure Private Zone log collection with Terraform:

resource "alicloud_log_audit" "dns_example" {
	display_name = "tf-audit-test-dns"
	aliuid       = "1480************"  // The management account.
	variable_map = {
		"dns_intranet_enabled" = "true", // Enables the collection of Private Zone logs.
		"dns_sync_enabled" = "true",     // Enables synchronization of regional logs to the central Project.
		"dns_intranet_ttl" = "3",        // Retains regional logs for 3 days.
		"dns_sync_ttl" = "185"					 // Retains logs in centralized storage for 185 days.
		"dns_intranet_collection_policy" = "accept tag.env == \\\"test\\\"\\ndrop \\\"*\\\"" // Enables Private Zone log collection only for VPC instances with the tag key 'env' and tag value 'test'.
	  }  
	multi_account = ["1039************"] // The multi-account configuration.
  }

Collection Policy

Private Zone log collection supports VPC-level granularity, allowing you to collect DNS logs for specific VPCs.

Use collection policies in the Log Audit console to filter logs. For example, collect private DNS logs only from VPC instances with the tag key 'env' and tag value 'prod'.

The collection policy configuration dialog box lets you toggle advanced edit mode and the default collection policy. To add a new policy, select an action (keep, drop, or accept) and filter by attributes such as account, region, instance ID, instance name, or tag. You can edit or delete existing policies. For example, drop instance.id == "vpc-2zettfw..." drops logs from a specific VPC instance, while accept "*" is the default accept policy.

Log analysis

The following are common Private Zone log query scenarios. You can also write custom SQL, add results to dashboards, save as quick queries, or create alerts.

1. DNS resolution result types

Distribution of DNS requests across domain names within a specified VPC over a specific period.

* and vpc_id: vpc-2ze9dducyc3t6p8aeksb3 |select count(*) as total_req, query_name group by query_name

After running the query, a pie chart on the chart tab displays the distribution of requests by domain name.

2. DNS resolution response time

Analyzes DNS resolution response time for a specific VPC, domain name, and query type.

* and vpc_id: vpc-2ze9dducyc3t6p8aeksb3 and query_name: "metrichub-cn-beijing.aliyun.com." and query_type: A | select stddev(__time__) as RT, dns_msg_id GROUP by dns_msg_id

The query returns 100 records in a table with two columns: RT and dns_msg_id. The RT value for all records is 0.0, indicating that the standard deviation of time is 0 for each dns_msg_id group.

3. Resolution exceptions

An ECS instance on Alibaba Cloud has resolution issues when querying a domain. The customer enables the private zone resolution log and stores these logs in SLS to analyze the cause. The SLS log can include the following three types: request log, global response log, and module response log.

Analysis process:

1. Use the src_port and dns_msg_id parameters to identify and filter log entries for a single resolution request.

2. The following fields distinguish the three log types:

   1. A log is a request log if the rt field is empty.

   2. A log is a module response log if the resolve_path field is empty.

   3. A log is a global response log if the resolve_path field is not empty.

3. Error result example

   Based on the preceding rules, the first entry is a request log, the second is a module response log, and the third is a global response log.

   The dns_msg_id for all three log entries is 59241. In the first log, module_type is GLOBAL and dns_msg_flags is RD. In the second log, module_type is RECURSION and dns_msg_flags is empty. In the third log, module_type is GLOBAL, dns_msg_flags is QR RD, and dst_addr is 100.100.2.136.

   1. A client initiates a DNS resolution request, expecting a recursive query.

   2. The request is sent to the recursive module, but the resolution fails.

   3. The server at 100.100.2.136 returns an error to the client.

4. Successful result example

   In successful DNS intranet log query results, typical key fields and values include: _source_ is log_dispatch, _topic_ is dns_intranet_log, module_type is GLOBAL or CACHE, query_type is A, dst_addr is 100.100.2.136, dst_port is 53, transport is UDP, answer_rset contains CNAME resolution records, and node_id is cn-shanghai.

   1. A client initiates a DNS resolution request, expecting a recursive query.

   2. The request is sent to the recursive module, and the resolution succeeds.

   3. The server at 100.100.2.136 returns the resolution result to the client.