Cloudflare Docs
Logs
Logs
Edit this page on GitHub
Set theme to dark (⇧+D)

Gateway DNS

The descriptions below detail the fields available for gateway_dns.

FieldValueType
ApplicationIDID of the application the domain belongs to (for example, 1, 2). Set to 0 when no ApplicationID is matched.int
ColoCodeThe name of the colo that received the DNS query (for example, ‘SJC’, ‘MIA’, ‘IAD’).string
ColoIDThe ID of the colo that received the DNS query (for example, 46, 72, 397).int
CustomResolveDurationMsThe time it took for the custom resolver to respond.int
CustomResolverAddressIP and port combo used to resolve the custom dns resolver query, if any.string
CustomResolverPolicyIDCustom resolver policy UUID, if matched.string
CustomResolverPolicyNameCustom resolver policy name, if matched.string
CustomResolverResponseStatus of the custom resolver response.string
DatetimeThe date and time the corresponding DNS request was made (for example, ‘2021-07-27T00:01:07Z’).int or string
DeviceIDUUID of the device where the HTTP request originated from (for example, ‘dad71818-0429-11ec-a0dc-000000000000’).string
DeviceNameThe name of the device where the HTTP request originated from (for example, ‘Laptop MB810’).string
DstIPThe destination IP address the DNS query was made to (for example, ‘104.16.132.2290’).string
DstPortThe destination port used at the edge. The port changes based on the protocol used by the DNS query (for example, 0).int
EmailEmail used to authenticate the client (for example, ‘user@test.com’).string
IsResponseCachedResponse comes from cache or not.bool
LocationName of the location the DNS request is coming from. Location is created by the customer (for example, ‘Office NYC’).string
LocationIDUUID of the location the DNS request is coming from. Location is created by the customer (for example, ‘7bdc7a9c-81d3-4816-8e56-000000000000’).string
MatchedCategoryIDsID or IDs of category that the domain was matched with the policy (for example, [7,12,28,122,129,163]).array[int]
MatchedCategoryNamesName or names of category that the domain was matched with the policy (for example, [‘Photography’, ‘Weather’]).array[string]
MatchedIndicatorFeedIDsID or IDs of indicator feed(s) that the domain was matched with the policy (for example, [7,12]).array[int]
MatchedIndicatorFeedNamesName or names of indicator feed(s) that the domain was matched with the policy (for example, [‘Vendor Malware Feed’, ‘Vendor CoC Feed’]).array[string]
PolicyName of the policy that was applied (if any) (for example, ‘7bdc7a9c-81d3-4816-8e56-de1acad3dec5’).string
PolicyIDID of the policy/rule that was applied (if any).string
ProtocolThe protocol used for the DNS query by the client (for example, ‘udp’).string
QueryCategoryIDsID or IDs of category that the domain belongs to (for example, [7,12,28,122,129,163]).array[int]
QueryCategoryNamesName or names of category that the domain belongs to (for example, [‘Photography’, ‘Weather’]).array[string]
QueryIndicatorFeedIDsID or IDs of indicator feed(s) that the domain belongs to (for example, [7,12,28]).array[int]
QueryIndicatorFeedNamesName or names of indicator feed(s) that the domain belongs to (for example, [‘Vendor Malware Feed’, ‘Vendor CoC Feed’, ‘Vendor Phishing Feed’]).array[string]
QueryNameThe query name (for example, ’example.com’).string
QueryNameReversedQuery name in reverse (for example, ‘com.example’).string
QuerySizeThe size of the DNS request in bytes (for example, 151).int
QueryTypeThe type of DNS query (for example, ‘1’, ‘28’, ‘15’, or ‘16’).string
QueryTypeNameThe type of DNS query (for example, ‘A’, ‘AAAA’, ‘MX’, or ‘TXT’).string
RCodeThe return code sent back by the DNS resolver.int
RDataThe rdata objects (for example, {“type”:“5”,“data”:“dns-packet-placeholder…”}).array[object]
ResolvedIPsThe resolved IPs in the response, if any (for example [‘203.0.113.1’, ‘203.0.113.2’]).array[string]
ResolverDecisionResult of the DNS query (for example, ‘overrideForSafeSearch’).string
SrcIPThe source IP address making the DNS query (for example, ‘104.16.132.229’).string
SrcPortThe port used by the client when they sent the DNS request (for example, 0).int
TimeZoneTime zone used to calculate the current time, if a matched rule was scheduled with it.string
TimeZoneInferredMethodMethod used to pick the time zone for the schedule (from rule/ from user ip/ from local time).string
UserIDUser identity where the HTTP request originated from (for example, ‘00000000-0000-0000-0000-000000000000’).string