Skip to content
Cloudflare Docs

DNS Firewall Logs

The descriptions below detail the fields available for dns_firewall_logs.

ClientResponseCode

Section titled “ClientResponseCode”

Type: int

Integer value of the response code Cloudflare presents to the client. Response code follows IANA parameters ↗.

ClusterID

Section titled “ClusterID”

Type: string

The ID of the cluster which handled this request.

ColoCode

Section titled “ColoCode”

Type: string

IATA airport code of the data center that received the request.

EDNSSubnet

Section titled “EDNSSubnet”

Type: string

IPv4 or IPv6 address information corresponding to the EDNS Client Subnet (ECS) forwarded by recursive resolvers. Not all resolvers send this information.

EDNSSubnetLength

Section titled “EDNSSubnetLength”

Type: int

Size of the EDNS Client Subnet (ECS) in bits. For example, if the last octet of an IPv4 address is omitted (192.0.2.x.), the subnet length will be 24.

QueryDO

Section titled “QueryDO”

Type: bool

Indicates if the client is capable of handling a signed response (DNSSEC answer OK).

QueryName

Section titled “QueryName”

Type: string

Name of the query that was sent.

QueryRD

Section titled “QueryRD”

Type: bool

Indicates if the client means a recursive query (Recursion Desired).

QuerySize

Section titled “QuerySize”

Type: int

The size of the query sent from the client in bytes.

QueryTCP

Section titled “QueryTCP”

Type: bool

Indicates if the query from the client was made via TCP (if false, then UDP).

QueryType

Section titled “QueryType”

Type: int

Integer value of query type. For more information refer to Query type ↗.

ResponseCached

Section titled “ResponseCached”

Type: bool

Whether the response was cached or not.

ResponseCachedStale

Section titled “ResponseCachedStale”

Type: bool

Whether the response was cached stale. In other words, the TTL had expired and the upstream nameserver was not reachable.

ResponseReason

Section titled “ResponseReason”

Type: string

Short descriptions with more context around the final DNS Firewall response. Refer to response reasons for more information.

SourceIP

Section titled “SourceIP”

Type: string

IP address of the client (IPv4 or IPv6).

Timestamp

Section titled “Timestamp”

Type: int or string

Timestamp at which the query occurred.

UpstreamIP

Section titled “UpstreamIP”

Type: string

IP of the upstream nameserver (IPv4 or IPv6).

UpstreamResponseCode

Section titled “UpstreamResponseCode”

Type: int

Integer value of the response code from the upstream nameserver. Response code follows IANA parameters ↗

UpstreamResponseTimeMs

Section titled “UpstreamResponseTimeMs”

Type: int

Upstream response time in milliseconds.