Cloudflare Docs
Edit this page on GitHub
Set theme to dark (⇧+D)

DNS Firewall Logs

The descriptions below detail the fields available for dns_firewall_logs.

ClientResponseCodeInteger value of the response code Cloudflare presents to the client. Response code follows IANA
ClusterIDThe ID of the cluster which handled this request.string
ColoCodeIATA airport code of data center that received the request.string
EDNSSubnetIPv4 or IPv6 address information corresponding to the EDNS Client Subnet (ECS) forwarded by recursive resolvers. Not all resolvers send this information.string
EDNSSubnetLengthSize of the EDNS Client Subnet (ECS) in bits. For example, if the last octet of an IPv4 address is omitted (192.0.2.x.), the subnet length will be
QueryDOIndicates if the client is capable of handling a signed response (DNSSEC answer OK).bool
QueryNameName of the query that was sent.string
QueryRDIndicates if the client means a recursive query (Recursion Desired).bool
QuerySizeThe size of the query sent from the client in
QueryTCPIndicates if the query from the client was made via TCP (if false, then UDP).bool
QueryTypeInteger value of query type. For more information refer to Query
ResponseCachedWhether the response was cached or not.bool
ResponseCachedStaleWhether the response was cached stale. In other words, the TTL had expired and the upstream nameserver was not reachable.bool
ResponseReasonShort descriptions with more context around the final DNS Firewall response. Refer to response reasons for more information.string
SourceIPIP address of the client (IPv4 or IPv6).string
TimestampTimestamp at which the query or string
UpstreamIPIP of the upstream nameserver (IPv4 or IPv6).string
UpstreamResponseCodeInteger value of the response code from the upstream nameserver. Response code follows IANA parametersint
UpstreamResponseTimeMsUpstream response time in