DNS logging is the retention of DNS query and response data so security teams can detect, investigate, and hunt malicious activity. These logs may include the requested domain, timestamp, source host, resolver, response code, and sometimes the answer returned. Because DNS is used by almost every device, it creates a valuable visibility layer across the network.
In cyber security, DNS logs help reveal threats that try to blend in with normal traffic. Malware may use DNS tunneling, domain generation algorithms, or suspicious lookups to reach command-and-control servers or move data covertly. Analysts can spot unusual query bursts, long or encoded subdomains, rare domains, or clients using unexpected resolvers. Centralized DNS logging also supports incident response by showing which systems contacted a domain, when the activity began, and whether other hosts were affected. Without DNS logs, many covert communications are much harder to prove.