← DNS Investigations: Resolution, Telemetry, and Threat Decisions
1. Understand What DNS Evidence Represents
Trace the Resolution Chain Read Records, TTLs, and Negative Answers
2. Collect and Evaluate Suspicious DNS Activity
Know Your Resolver Telemetry and Blind Spots Assess Domains Without Turning Heuristics into Verdicts
3. Test Threat Hypotheses and Respond
Test Tunneling and Beaconing Hypotheses Pivot, Scope, Block, and Report
2. Collect and Evaluate Suspicious DNS Activity

Know Your Resolver Telemetry and Blind Spots

Inventory managed resolvers, forwarders, endpoint sensors, encrypted DNS, retention, and identity joins before trusting a query history.

In this lesson, you will learn to:

  • Map the enterprise DNS collection and enforcement path.
  • Identify when client, process, answer, or upstream visibility is missing.

Know Your Resolver Telemetry and Blind Spots

Teaches collection architecture, protective DNS, log fields, dynamic addressing, encrypted transports, bypass paths, and evidence-quality checks.

Map the managed resolution path

Inventory the resolution path for office networks, VPN clients, remote endpoints, cloud workloads, containers, and mobile devices. Record configured recursive resolvers, conditional forwarders, split-horizon zones, protective DNS services, egress controls, and fallback behavior. A managed resolver can enforce policy and produce high-value logs, but only for queries that reach it. Local caches, browser or application DNS, virtual networks, and unmanaged resolvers can create parallel paths.

For each source, identify fields and semantics: original client address or forwarded source, query name and type, response code, answer, policy action, upstream resolver, transport, latency, and timestamps. Determine whether logs capture allowed and blocked queries, cache hits, responses, and full names. Privacy and retention requirements may limit labels or client attribution. Preserve a data dictionary and version because product updates can rename or normalize fields. A “blocked” field proves a policy action at that resolver; it does not prove every possible connection path was prevented.

DNS sensors surround different parts of the pathEndpoint, recursive service, network controls, cloud resolvers, and authoritative views overlap but do not provide identical evidence.FIELD GUIDEDNS sensors surround different parts of the pathDECISION CUEEndpointprocessAuthoritative viewEndpoint processManaged resolverNetwork and egressCloud and remote pathsAuthoritative viewSENSOR RINGS
DNS sensors surround different parts of the path — Endpoint, recursive service, network controls, cloud resolvers, and authoritative views overlap but do not provide identical evidence.

Measure blind spots and evidence quality

Encrypted DNS protects query transport from intermediate observers, but its security effect depends on endpoints and resolver policy. DNS over HTTPS or TLS to an approved enterprise resolver can preserve managed control; use to an external resolver may bypass a network sensor or policy point unless endpoints and egress are governed. Do not label encryption itself malicious. Identify the destination service, initiating process, device policy, and whether approved telemetry remains available.

Continuously measure collection health: active clients with no DNS logs, resolver clock drift, ingestion lag, parsing errors, abrupt volume drops, missing response fields, and dynamic-address joins that fail. Maintain DHCP, VPN, cloud instance, and network address history long enough to attribute a client at event time. Endpoint DNS events can restore process context but may be filtered or sampled. Resolver logs can show the query but not which process caused it. State the strongest attribution supported: user, device, workload, address, or resolver only.

Collection quality is a sequence of required gatesCoverage, client attribution, response fields, time alignment, retention, and parser health determine whether DNS conclusions are supportable.FIELD GUIDECollection quality is a sequence of required gatesQuery reachedsensorClientattributedAnswerpreservedTime andparser healthyWORKFLOWQuery reached sensorTime and parser healthyQUALITY GATES
Collection quality is a sequence of required gates — Coverage, client attribution, response fields, time alignment, retention, and parser health determine whether DNS conclusions are supportable.

Resources

← Previous: Read Records, TTLs, and Negative Answers Next: Assess Domains Without Turning Heuristics into Verdicts →