Cloudflare Docs
Edit this page on GitHub
Set theme to dark (⇧+D)


To access analytics for your DNS Firewall, use the Cloudflare API.

Alternatively, set up Logpush to deliver DNS Firewall logs to a storage service, SIEM, or log management provider.

​​ Response reasons

When analyzing why Cloudflare DNS Firewall responded in one way or another to a specific query, consider the responseReason log field.

The following table provides a description for each of the values that might be returned as a response reason:

successResponse was successfully served, either from Cloudflare cache or forwarded from the upstream.
upstream_failureResponse could not be fetched from the upstream due to the upstream failing to respond.
upstream_servfailResponse could not be fetched from the upstream due to the upstream responding with SERVFAIL.
invalid_queryQuery is invalid and cannot be processed.
any_type_blockedQuery of type ANY was blocked according to your DNS Firewall settings ( RFC 8482).
rate_limitQuery was rate limited according to your DNS Firewall settings.
chaos_successResponse for Chaos class was successfully served.
attack_mitigation_blockQuery was blocked as part of random prefix attack mitigation.
unknownThere was an unknown error.