DNS views

Three Security tabs read the DNS query log that the node DNS writes. They are empty until the node DNS runs on the supervisor and its Query log switch is on; capture decides whether a workload with a resolver of its own is in them too.

​

DNS Queries

Every DNS query a pod or VM on the supervisor asked: who asked, what, and what came back.

• Tiles: queries and their rate, distinct names and how many sources asked them, failures (NXDOMAIN and SERVFAIL), cache hits with the p95 latency, and blocked queries.
• Views: Names (one row per name, with how each was answered), Sources (one row per asking workload) and Log (each query).
• Filters: window (5 minutes to 7 days), project, outcome, record type, cache, and Search-list steps — the extra lookups a resolver makes while it walks its search domains. CSV exports what is shown.

Each query is counted under exactly one outcome: Not in the log: the nodes’ own queries, hostNetwork pods, DNS over HTTPS to an address written into a client, and any supervisor without the node DNS. Rows are kept 14 days. At a project address the tab shows that project’s own queries only.

​

Blocked DNS

Who tried to resolve or reach DNS the supervisor blocks:

• an encrypted-DNS server name (DoH, DoT, DoQ), when Global DNS blocks them;
• a malicious name answered with the sinkhole, when Global DNS answers them;
• a denied connection: DNS sent to a resolver other than the node DNS, refused by Deny DNS anywhere else.

The tiles count the sources that tried, the blocked and sinkholed names, and the denied connections. When a block is off, the tab says so: only denied connections can show then. Blocked DNS reads the whole supervisor, so it is not offered at a project address.

​

DNS Honeypot

With the honeypot on (Global DNS, or this supervisor’s Networking → DNS), malicious names resolve to the honeypot’s reserved address instead of a sinkhole, and every connection to it is recorded here: the client, the port, and what it tried — the TLS server name, the HTTP request, the first bytes it sent. Without the honeypot, malicious names resolve to a sinkhole address that goes nowhere and nothing is recorded; the tab then says which address the honeypot would take and offers to turn it on for this supervisor. At a project address the tab shows that project’s own clients.

​

API and MCP

All three are security:Read. DNS Queries and DNS Honeypot also have a project form of the route (/api/supervisors/{name}/projects/{project}/security/...), authorised on the project’s KRN, so a tenant can be granted their own queries and nothing else.

​

Related