Follow Windows DNS Server logs to three places in Event Viewer, plus an optional text file:
- Microsoft → Windows → DNS-Server → Audit: zone and record changes. On by default on current Windows Server.
- Microsoft → Windows → DNS-Server → Analytical: every query and response. Off by default and hidden until you show analytic logs.
- DNS Server, under Applications and Services Logs: service-level events such as starts, stops and zone load errors.
- The debug log, a text file you enable in DNS Manager, usually C:\Windows\System32\dns\dns.log.
The core export is one line from an elevated prompt:
wevtutil epl "Microsoft-Windows-DNSServer/Audit" C:\logs\dns_audit.evtx
Almost everything on a network makes DNS queries, malware included. Query logs expose DNS tunneling, domain-generation algorithms and calls to known-bad domains. Audit logs expose someone quietly changing records. Prime Core has {N} detection rules for DNS data, mapped to {M} MITRE ATT&CK techniques. Among them: command-and-control over DNS (T1071.004) and domain-generation algorithms (T1568.002).
Before you start
Query logging probably wasn’t on. The Analytical channel is off by default. If you’re investigating something that already happened, there are likely no query logs from the server. Your options are the client side (Sysmon event 22, or the DNS Client log), firewall or proxy logs, or a network sensor. Turning it on now helps from here forward.
Turn on query logging (for the future). In Event Viewer, choose View → Show Analytic and Debug Logs, then right-click Analytical under DNS-Server and choose Enable Log. Or from the command line:
wevtutil sl "Microsoft-Windows-DNSServer/Analytical" /e:true
Microsoft describes the overhead as modest, but on a very busy resolver, test before you leave it on.
You need an elevated prompt, on the DNS server or on a domain controller running DNS.
Export the logs
:: record and zone changes
wevtutil epl "Microsoft-Windows-DNSServer/Audit" C:\logs\dns_audit.evtx
:: service-level events
wevtutil epl "DNS Server" C:\logs\dns_server.evtx
:: queries and responses (only if Analytical was enabled)
wevtutil epl "Microsoft-Windows-DNSServer/Analytical" C:\logs\dns_analytical.evtx
Analytic channels behave differently from normal logs. Event Viewer may ask you to disable the log before it shows events. PowerShell’s Get-WinEvent reads them only with -Oldest.
The debug log is plain text, configured in DNS Manager → server Properties → Debug Logging. It records packets in detail, and it rolls over when it hits its size limit, overwriting older entries. Copy it as-is: copy C:\Windows\System32\dns\dns.log C:\logs\.
What to look for
| Signal | What it can mean |
|---|---|
| Very long, random-looking subdomains in queries | DNS tunneling, data smuggled out in query names |
| One client generating many failed lookups (NXDOMAIN) | Malware cycling through generated domains |
| A high volume of TXT queries from one host | Tunneling or command-and-control |
| Audit events for records created, deleted or changed outside change windows | Record hijacking, e.g. a new wpad record |
| A plugin DLL loaded by the DNS Server service | Abuse of the DnsAdmins group to run code as SYSTEM |
Upload and review in LogTotal
LogTotal reads EVTX natively. One thing to know first: LogTotal doesn’t sanitize EVTX files yet. DNS logs carry internal hostnames and client IPs. Treat an upload as handing over the raw file: fine for test servers; for production, get a yes from whoever owns data handling first.
If you need sanitization today, convert to JSON first: evtx_dump -o jsonl dns_audit.evtx > dns_audit.jsonl.
- Upload. Open logtotal.com and drop in the file.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| No Analytical channel in Event Viewer | Analytic logs are hidden by default | View → Show Analytic and Debug Logs |
| Analytical channel is empty | It was never enabled | Enable it; no history before that |
| Get-WinEvent errors on the Analytical log | Analytic logs need -Oldest | Add -Oldest |
| Audit channel missing | Older Windows Server without the update | Check the OS version; use the debug log |
| Debug log covers only a short time | It overwrote itself at the size limit | Raise the limit, or forward logs elsewhere |
FAQ
Server logs or client logs?
The DNS server tells you which client IP asked. Only the client tells you which process asked. That’s why Sysmon event 22 on endpoints complements server logs so well.
Is the debug log better than the Analytical channel?
The debug log holds more packet detail but costs more and overwrites itself. For most investigations, the Analytical channel is the better default.
