> ## Documentation Index
> Fetch the complete documentation index at: https://docs.celum.io/llms.txt
> Use this file to discover all available pages before exploring further.

# DNS views

> DNS Queries, Blocked DNS and DNS Honeypot: what every workload asked, who tried DNS the supervisor blocks, and who reached the honeypot.

Three Security tabs read the DNS query log that the [node DNS](https://docs.celum.io/networking/dns.md) writes. They are empty until the node DNS runs on the supervisor and its **Query log** switch is on; capture decides whether a workload with a resolver of its own is in them too.

## DNS Queries

Every DNS query a pod or VM on the supervisor asked: who asked, what, and what came back.

* **Tiles:** queries and their rate, distinct names and how many sources asked them, failures (NXDOMAIN and SERVFAIL), cache hits with the p95 latency, and blocked queries.
* **Views:** **Names** (one row per name, with how each was answered), **Sources** (one row per asking workload) and **Log** (each query).
* **Filters:** window (5 minutes to 7 days), project, outcome, record type, cache, and **Search-list steps** — the extra lookups a resolver makes while it walks its search domains. **CSV** exports what is shown.

Each query is counted under exactly one outcome:

| Outcome | Meaning |
| - | - |
| **answered** IPv4 · IPv6 · PTR | the answer held at least one record of the type asked |
| **NODATA** IPv4 · IPv6 · other | the name exists but has no record of that type. Pods ask A and AAAA together, so on a supervisor without IPv6, NODATA IPv6 is normal |
| **NX** | NXDOMAIN: the name does not exist |
| **SERVFAIL** | the resolver could not answer, for example an internal DNS timed out; the client asks again |
| **blocked** | Celum stopped it: an encrypted-DNS server name (NXDOMAIN with EDE 15) or a malicious name answered with the sinkhole. A blocked name also comes back NXDOMAIN, but counts as blocked |

**Not in the log:** the nodes' own queries, hostNetwork pods, DNS over HTTPS to an address written into a client, and any supervisor without the node DNS. Rows are kept 14 days.

At a project address the tab shows that project's own queries only.

## Blocked DNS

Who tried to resolve or reach DNS the supervisor blocks:

* an encrypted-DNS server name (DoH, DoT, DoQ), when Global DNS blocks them;
* a malicious name answered with the sinkhole, when Global DNS answers them;
* a **denied connection**: DNS sent to a resolver other than the node DNS, refused by **Deny DNS anywhere else**.

The tiles count the sources that tried, the blocked and sinkholed names, and the denied connections. When a block is off, the tab says so: only denied connections can show then.

Blocked DNS reads the whole supervisor, so it is not offered at a project address.

## DNS Honeypot

With the honeypot on (Global DNS, or this supervisor's **Networking → DNS**), malicious names resolve to the honeypot's reserved address instead of a sinkhole, and every connection to it is recorded here: the client, the port, and what it tried — the TLS server name, the HTTP request, the first bytes it sent.

Without the honeypot, malicious names resolve to a sinkhole address that goes nowhere and nothing is recorded; the tab then says which address the honeypot would take and offers to turn it on for this supervisor.

At a project address the tab shows that project's own clients.

## API and MCP

| View | Route | MCP |
| - | - | - |
| DNS Queries | `GET /api/supervisors/{name}/security/flows/dns-queries`, and `.../summary`, `.../top`, `.../resolution`, `.../block-source` | `list_dns_queries`, `get_dns_query_summary`, `get_dns_query_top`, `get_dns_query_resolution`, `get_dns_block_source` |
| Blocked DNS | `GET /api/supervisors/{name}/security/flows/dns-blocked` | `get_dns_blocked_attempts` |
| DNS Honeypot | `GET /api/supervisors/{name}/security/flows/dns-honeypot` | `list_dns_honeypot_events` |

All three are `security:Read`. DNS Queries and DNS Honeypot also have a project form of the route (`/api/supervisors/{name}/projects/{project}/security/...`), authorised on the project's KRN, so a tenant can be granted their own queries and nothing else.

## Related

> [card] [DNS](https://docs.celum.io/networking/dns.md)
>
> Running the node DNS, the query log, and the blocks these views report on.

> [card] [Security overview](https://docs.celum.io/security/overview.md)
>
> The other Security tabs, and how to tell no data from no traffic.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.