Gateway DNS
The descriptions below detail the fields available for gateway_dns.
AccountID
Section titled “AccountID”Type: string
Cloudflare account ID.
ApplicationID
Section titled “ApplicationID”Type: int
ID of the application the domain belongs to (for example, 1, 2). Set to 0 when no ApplicationID is matched.
ApplicationName
Section titled “ApplicationName”Type: string
Name of the application the domain belongs to (for example, 'Cloudflare Dashboard').
AuthoritativeNameServerIPs
Section titled “AuthoritativeNameServerIPs”Type: array[string]
The IPs of the authoritative nameservers that provided the answers, if any (for example ['203.0.113.1', '203.0.113.2']).
CNAMECategoryIDs
Section titled “CNAMECategoryIDs”Type: array[int]
ID or IDs of category that the intermediate cname domains belongs to (for example, [7,12,28,122,129,163]).
CNAMECategoryNames
Section titled “CNAMECategoryNames”Type: array[string]
Name or names of category that the intermediate cname domains belongs to (for example, ['Photography', 'Weather']).
CNAMEs
Section titled “CNAMEs”Type: array[string]
Resolved intermediate cname domains (for example, ['alias.example.com']).
CNAMEsReversed
Section titled “CNAMEsReversed”Type: array[string]
Resolved intermediate cname domains in reverse (for example, ['com.example.alias']).
ColoCode
Section titled “ColoCode”Type: string
The name of the data center that received the DNS query (for example, 'SJC', 'MIA', 'IAD').
ColoID
Section titled “ColoID”Type: int
The ID of the data center that received the DNS query (for example, 46, 72, 397).
CustomResolveDurationMs
Section titled “CustomResolveDurationMs”Type: int
The time it took for the custom resolver to respond.
CustomResolverAddress
Section titled “CustomResolverAddress”Type: string
IP and port combo used to resolve the custom dns resolver query, if any.
CustomResolverPolicyID (deprecated)
Section titled “CustomResolverPolicyID (deprecated)”Type: string
Custom resolver policy UUID, if matched. Deprecated by ResolverPolicyID.
CustomResolverPolicyName (deprecated)
Section titled “CustomResolverPolicyName (deprecated)”Type: string
Custom resolver policy name, if matched. Deprecated by ResolverPolicyName.
CustomResolverResponse
Section titled “CustomResolverResponse”Type: string
Status of the custom resolver response.
Datetime
Section titled “Datetime”Type: int or string
The date and time the corresponding DNS request was made (for example, '2021-07-27T00:01:07Z').
DeviceID
Section titled “DeviceID”Type: string
UUID of the device where the HTTP request originated from (for example, 'dad71818-0429-11ec-a0dc-000000000000').
DeviceName
Section titled “DeviceName”Type: string
The name of the device where the HTTP request originated from (for example, 'Laptop MB810').
DoHSubdomain
Section titled “DoHSubdomain”Type: string
The destination DoH subdomain the DNS query was made to.
DoTSubdomain
Section titled “DoTSubdomain”Type: string
The destination DoT subdomain the DNS query was made to.
Type: string
The destination IP address the DNS query was made to (for example, '104.16.132.2290').
DstPort
Section titled “DstPort”Type: int
The destination port used at the edge. The port changes based on the protocol used by the DNS query (for example, 0).
EDEErrors
Section titled “EDEErrors”Type: array[int]
List of returned Extended DNS Error Codes (for example, [2, 3]).
Type: string
Email used to authenticate the client (for example, 'user@test.com').
InitialCategoryIDs
Section titled “InitialCategoryIDs”Type: array[int]
ID or IDs of category that the queried domains belongs to (for example, [7,12,28,122,129,163]).
InitialCategoryNames
Section titled “InitialCategoryNames”Type: array[string]
Name or names of category that the queried domains belongs to (for example, ['Photography', 'Weather']).
InitialResolvedIPs
Section titled “InitialResolvedIPs”Type: array[string]
The IPs used to correlate existing FQDN matching policy between Gateway DNS and Gateway proxy.
InternalDNSFallbackStrategy
Section titled “InternalDNSFallbackStrategy”Type: string
The fallback strategy applied over the internal DNS response. Empty if no fallback strategy was applied.
InternalDNSRCode
Section titled “InternalDNSRCode”Type: int
The return code sent back by the internal DNS service.
InternalDNSViewID
Section titled “InternalDNSViewID”Type: string
The DNS internal view identifier that was sent to the internal DNS service.
InternalDNSZoneID
Section titled “InternalDNSZoneID”Type: string
The DNS zone identifier returned by the internal DNS service.
IsResponseCached
Section titled “IsResponseCached”Type: bool
Response comes from cache or not.
Location
Section titled “Location”Type: string
Name of the location the DNS request is coming from. Location is created by the customer (for example, 'Office NYC').
LocationID
Section titled “LocationID”Type: string
UUID of the location the DNS request is coming from. Location is created by the customer (for example, '7bdc7a9c-81d3-4816-8e56-000000000000').
MatchedCategoryIDs
Section titled “MatchedCategoryIDs”Type: array[int]
ID or IDs of category that the domain was matched with the policy (for example, [7,12,28,122,129,163]).
MatchedCategoryNames
Section titled “MatchedCategoryNames”Type: array[string]
Name or names of category that the domain was matched with the policy (for example, ['Photography', 'Weather']).
MatchedIndicatorFeedIDs
Section titled “MatchedIndicatorFeedIDs”Type: array[int]
ID or IDs of indicator feed(s) that the domain was matched with the policy (for example, [7,12]).
MatchedIndicatorFeedNames
Section titled “MatchedIndicatorFeedNames”Type: array[string]
Name or names of indicator feed(s) that the domain was matched with the policy (for example, ['Vendor Malware Feed', 'Vendor CoC Feed']).
Policy (deprecated)
Section titled “Policy (deprecated)”Type: string
Name of the policy that was applied (if any) (for example, '7bdc7a9c-81d3-4816-8e56-de1acad3dec5').
PolicyID
Section titled “PolicyID”Type: string
ID of the policy/rule that was applied (if any).
PolicyName
Section titled “PolicyName”Type: string
Name of the policy that was applied (if any).
Protocol
Section titled “Protocol”Type: string
The protocol used for the DNS query by the client (for example, 'udp').
QueryCategoryIDs
Section titled “QueryCategoryIDs”Type: array[int]
Union of all categories; Initial categories + Resolved IP categories + Cname intermediate categories
QueryCategoryNames
Section titled “QueryCategoryNames”Type: array[string]
Union of all category names; Initial categories + Resolved IP categories + Cname intermediate categories
QueryID
Section titled “QueryID”Type: string
Globally unique identifier of the query.
QueryIndicatorFeedIDs
Section titled “QueryIndicatorFeedIDs”Type: array[int]
ID or IDs of indicator feed(s) that the domain belongs to (for example, [7,12,28]).
QueryIndicatorFeedNames
Section titled “QueryIndicatorFeedNames”Type: array[string]
Name or names of indicator feed(s) that the domain belongs to (for example, ['Vendor Malware Feed', 'Vendor CoC Feed', 'Vendor Phishing Feed']).
QueryName
Section titled “QueryName”Type: string
The query name (for example, 'example.com'). Cloudflare will surface '.' for root server queries in your logs.
QueryNameReversed
Section titled “QueryNameReversed”Type: string
Query name in reverse (for example, 'com.example'). Cloudflare will surface '.' for root server queries in your logs.
QuerySize
Section titled “QuerySize”Type: int
The size of the DNS request in bytes (for example, 151).
QueryType
Section titled “QueryType”Type: int
The type of DNS query (for example, 1, 28, 15, or 16).
QueryTypeName
Section titled “QueryTypeName”Type: string
The type of DNS query (for example, 'A', 'AAAA', 'MX', or 'TXT').
Type: int
The return code sent back by the DNS resolver.
RData (deprecated)
Section titled “RData (deprecated)”Type: array[object]
The rdata objects (for example, [{"type":"5","data":"dns-packet-placeholder..."}]).
RedirectTargetURI
Section titled “RedirectTargetURI”Type: string
Custom URI to which the user was redirected, if any.
RegistrationID
Section titled “RegistrationID”Type: string
The UUID of the device registration from which the HTTP request originated (for example, 'dad71818-0429-11ec-a0dc-000000000000').
RequestContextCategoryIDs
Section titled “RequestContextCategoryIDs”Type: array[int]
ID or IDs of the category that was sent to gateway in the EDNS request for filtering (for example, [7,12,28,122,129,163]).
RequestContextCategoryNames
Section titled “RequestContextCategoryNames”Type: array[string]
Name or names of the category that was sent to gateway in the EDNS request for filtering (for example, ['Photography', 'Weather']).
ResolvedIPCategoryIDs
Section titled “ResolvedIPCategoryIDs”Type: array[int]
ID or IDs of category that the ips in the response belongs to (for example, [7,12,28,122,129,163]).
ResolvedIPCategoryNames
Section titled “ResolvedIPCategoryNames”Type: array[string]
Name or names of category that the ips in the response belongs to (for example, ['Photography', 'Weather']).
ResolvedIPContinentCodes
Section titled “ResolvedIPContinentCodes”Type: array[string]
Continent code of each resolved IP, if any (for example ['NA', 'EU']).
ResolvedIPCountryCodes
Section titled “ResolvedIPCountryCodes”Type: array[string]
Country code of each resolved IP, if any (for example ['US', 'PT']).
ResolvedIPs
Section titled “ResolvedIPs”Type: array[string]
The resolved IPs in the response, if any (for example ['203.0.113.1', '203.0.113.2']).
ResolverDecision
Section titled “ResolverDecision”Type: string
Result of the DNS query (for example, 'overrideForSafeSearch').
ResolverPolicyID
Section titled “ResolverPolicyID”Type: string
Resolver policy UUID, if any matched.
ResolverPolicyName
Section titled “ResolverPolicyName”Type: string
Resolver policy name, if any matched.
ResourceRecords
Section titled “ResourceRecords”Type: array[object]
The rdata objects (for example, [{"type":"5","data":"dns-packet-placeholder..."}]).
ResourceRecordsJSON
Section titled “ResourceRecordsJSON”Type: string
String that represents the JSON array with the returned resource records (for example, '[{"name": "example.com", "type": "CNAME", "class": "IN", "ttl": 3600, "rdata": "cname.example.com."}]').
Type: string
The source IP address making the DNS query (for example, '104.16.132.229').
SrcIPContinentCode
Section titled “SrcIPContinentCode”Type: string
Continent code of the source IP address making the DNS query (for example, 'NA').
SrcIPCountryCode
Section titled “SrcIPCountryCode”Type: string
Country code of the source IP address making the DNS query (for example, 'US').
SrcPort
Section titled “SrcPort”Type: int
The port used by the client when they sent the DNS request (for example, 0).
TimeZone
Section titled “TimeZone”Type: string
Time zone used to calculate the current time, if a matched rule was scheduled with it.
TimeZoneInferredMethod
Section titled “TimeZoneInferredMethod”Type: string
Method used to pick the time zone for the schedule (from rule/ from user ip/ from local time).
UserID
Section titled “UserID”Type: string
User identity where the HTTP request originated from (for example, '00000000-0000-0000-0000-000000000000').
Was this helpful?
- Resources
- API
- New to Cloudflare?
- Products
- Sponsorships
- Open Source
- Support
- Help Center
- System Status
- Compliance
- GDPR
- Company
- cloudflare.com
- Our team
- Careers
- 2025 Cloudflare, Inc.
- Privacy Policy
- Terms of Use
- Report Security Issues
- Trademark