All Products
Search

This Product

    Alibaba Cloud DNS:Store Public Zone logs in Simple Log Service

    Document Center

    Alibaba Cloud DNS:Store Public Zone logs in Simple Log Service

    Last Updated:Jun 04, 2026

    Store your Public Zone DNS resolution logs in Simple Log Service (SLS) to audit domain usage and detect security issues.

    Public Zone resolution logs

    Alibaba Cloud DNS integrates with Simple Log Service (SLS) to store Public Zone resolution logs. Enable log storage through the Log Audit Service application.

    Enable Public Zone log auditing

    Important

    DNS traffic analysis must be enabled for the domain name before logs can be stored in SLS. Enable or disable network traffic analysis for a domain name. Disabling traffic analysis stops log generation.

    1. Log in to the SLS console.

    2. In the Log Application section, select the Audit & Security tab, and then click Log Audit Service.

    3. On the Global Configurations page, enable public DNS resolution log auditing and select a Region for Central project, such as China (Hangzhou). Enable and manage log collection. In the cloud product audit log configurations, find DNS and verify that Public DNS resolution logs collection is enabled with a centralized policy.

    View Public Zone resolution logs

    1. Log in to the Simple Log Service console.

    2. In the project list, click your target project.

    3. In the left-side Logstore list, click dns_log to view resolution log details.

    Public Zone resolution log fields

    Log field

    Description

    Example

    additional_rrset

    Additional resource records provided by the DNS server beyond the direct answer, typically to improve resolution efficiency.

    Json array:

    ["mail.example.com. 3600 IN A 93.184.XX.XX"]

    answer_rrset

    Resource records that directly answer the DNS query.

    Json array:

    ["cloud-example.com. 600 MX 15 mx3.qiye.aliyun.com.", "cloud-example.com. 600 MX 10 mx2.qiye.aliyun.com."]

    authority_rrset

    Authoritative name servers for the queried domain, included when the responding server is not authoritative.

    Json array:

    ["example.com. 172800 IN NS ns1.example.com. example.com. 172800 IN NS ns2.example.com." ]

    dns_msg_flags

    • QR: 1 indicates a server response; 0 indicates a client request.

    • RD: 0 indicates that a recursive query is not requested; 1 indicates that a recursive query is requested.

    • AA: 1 indicates an authoritative answer; 0 indicates a non-authoritative answer.

    • TC: 1 indicates the message was truncated; 0 indicates it was not.

    QR RD AA

    dns_msg_id

    Unique identifier for the DNS query.

    55346

    dst_addr

    Destination IP address of the response packet, typically the egress IP of the local DNS server.

    61.240.XX.XX

    dst_port

    Destination port of the response packet, typically the port of the local DNS server.

    52322

    edns

    EDNS (Extension Mechanisms for DNS) extends the DNS protocol to support larger packets, additional status codes, and other features.

    UDP: Maximum UDP packet size (in bytes) the sender supports, allowing negotiation beyond the traditional 512-byte limit.

    flag: 8-bit flag field in the OPT resource record. The most common flag is DO (DNSSEC OK), indicating the sender supports DNSSEC-signed data.

    CLIENT_SUBNET: Information about the client subnet.

    UDP: 1400 flags: DO CLIENT_SUBNET: 124.163.XX.XX/24/24

    query_name

    Queried domain name.

    www.example.com.

    query_type

    Record type requested (A, AAAA, CNAME, TXT, MX, etc.).

    A

    rcode

    Response status code.

    • 0: NOERROR. The query succeeded.

    • 1: FORMERR. The server could not parse the request due to a format error.

    • 2: SERVFAIL. The server encountered an internal error or timeout.

    • 3: NXDOMAIN. The domain name does not exist.

    • 4: NOTIMP. The server does not support the requested operation.

    • 5: REFUSED. The server refused the request for policy or security reasons.

    • 8: NXRRSET. The domain name exists, but the requested record type does not.

    0

    region_id

    Region where the log was generated.

    cn-shanghai

    rt

    Time from request receipt to response by the authoritative DNS server. Does not include end-to-end resolution time.

    0 ms

    src_addr

    IP address of the authoritative DNS server that sent the response.

    8.212.XX.XX

    src_port

    Port of the authoritative DNS server that sent the response.

    53

    transport

    Transport protocol.

    UDP

    user_id

    Alibaba Cloud account ID.

    139749398683****

    value

    Value portion of resource records in the answer_rrset field.

    Json array:

    ["mx3.qiye.aliyun.com." ,"mx2.qiye.aliyun.com."]

    view_name

    DNS resolution line that handled the query.

    DEFAULT

    wild_len

    Length of the matched wildcard domain, if applicable.

    25

    z_name

    Authoritative zone containing the queried domain.

    cloud-example.com