DNS Firewall Logs

The descriptions below detail the fields available for dns_firewall_logs.

Field	Value	Type
ClientResponseCode	Integer value of the response code Cloudflare presents to the client. Response code follows IANA parameters.	int
ClusterID	The ID of the cluster which handled this request.	string
ColoCode	IATA airport code of data center that received the request.	string
EDNSSubnet	IPv4 or IPv6 address information corresponding to the EDNS Client Subnet (ECS) forwarded by recursive resolvers. Not all resolvers send this information.	string
EDNSSubnetLength	Size of the EDNS Client Subnet (ECS) in bits. For example, if the last octet of an IPv4 address is omitted (`192.0.2.x.`), the subnet length will be 24.	int
QueryDO	Indicates if the client is capable of handling a signed response (DNSSEC answer OK).	bool
QueryName	Name of the query that was sent.	string
QueryRD	Indicates if the client means a recursive query (Recursion Desired).	bool
QuerySize	The size of the query sent from the client in bytes.	int
QueryTCP	Indicates if the query from the client was made via TCP (if false, then UDP).	bool
QueryType	Integer value of query type. For more information refer to Query type.	int
ResponseCached	Whether the response was cached or not.	bool
ResponseCachedStale	Whether the response was cached stale. In other words, the TTL had expired and the upstream nameserver was not reachable.	bool
ResponseReason	Short descriptions with more context around the final DNS Firewall response. Refer to response reasons for more information.	string
SourceIP	IP address of the client (IPv4 or IPv6).	string
Timestamp	Timestamp at which the query occurred.	int or string
UpstreamIP	IP of the upstream nameserver (IPv4 or IPv6).	string
UpstreamResponseCode	Integer value of the response code from the upstream nameserver. Response code follows IANA parameters	int
UpstreamResponseTimeMs	Upstream response time in milliseconds.	int