Get desktop application:
View/edit binary Protocol Buffers messages
Used in:
Type of event
UUID, shared by the query and the response
ID of the server emitting the protobuf message
DNS requestor (client) as 4 (IPv4) or 16 (IPv6) raw bytes in network byte order
DNS responder (server) as 4 (IPv4) or 16 (IPv6) raw bytes in network byte order
Size of the query or response on the wire
Time of message reception (seconds since epoch)
Time of message reception (additional micro-seconds)
ID of the query/response as found in the DNS header
DNS query received from client
EDNS Client Subnet value (4 or 16 raw bytes in network byte order)
Username of the requestor
UUID of the incoming query that initiated this outgoing query or incoming response
Device ID of the requestor (could be mac address IP address or e.g. IMEI, format implementation dependent)
True if the domain has not been seen before
Device name of the requestor
Source port of the DNS query (client)
Destination port of the DNS query (server)
Arbitrary meta-data - to be used in future rather than adding new fields all the time
HTTP version used for DNS over HTTP
Thread id
Was it a packet cache hit?
Number of outgoing queries used to answer the query
Flags field in wire format, 16 bits used
EDNS version and flags in wire format, see https://www.rfc-editor.org/rfc/rfc6891.html#section-6.1.3
Used in:
Fully qualified DNS name (with trailing dot)
https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4
Typically 1 (IN), see https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-2
Used in:
DNS Response code, or 65536 for a network error including a timeout
DNS resource records in response
Filtering policy (RPZ or Lua) applied
Additional tags applied
Time of the corresponding query reception (seconds since epoch)
Time of the corresponding query reception (additional micro-seconds)
Type of the filtering policy (RPZ or Lua) applied
The RPZ trigger
The value (qname or IP) that caused the hit
The Kind (RPZ action) applied by the hit
The DNSSEC Validation State
See exportTypes in https://docs.powerdns.com/recursor/lua-config/protobuf.html#protobufServer for the list of supported resource record types.
Used in:
Fully qualified DNS name (with trailing dot)
https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-4
Typically 1 (IN), see https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-2
TTL in seconds
raw address bytes in network byte order for A & AAAA; text representation for others, with fully qualified (trailing dot) domain names
True if this is the first time this RR has been seen for this question
Used in:
Timestamp in ns relative to time of creation of event trace data structure
Type of event
true for "start" events, false for "completed" events
Below are optional values associated with events
The name of the event for custom events
The well known EventTrace event numbers
Used in:
Range 0..99: Generic events
A custom event
A request was received
A packet cache check was initiated or completed; value: bool cacheHit
An answer was sent to the client
Range 100: Recursor events
Recursor Syncres main function has started or completed; value: int rcode
Events below mark start or end of Lua hook calls; value: return value of hook
Used in:
HTTP/1.1
HTTP/2
HTTP/3
Used in:
MUST be unique, so if you have multiple values they must be aggregated into one Meta
Used in:
Used in:
No action taken
https://tools.ietf.org/html/draft-vixie-dns-rpz-04 3.4
https://tools.ietf.org/html/draft-vixie-dns-rpz-04 3.1
https://tools.ietf.org/html/draft-vixie-dns-rpz-04 3.2
https://tools.ietf.org/html/draft-vixie-dns-rpz-04 3.5
https://tools.ietf.org/html/draft-vixie-dns-rpz-04 3.6
Used in:
No RPZ policy applied, or unknown type
Policy matched on the QName
Policy matched on the client IP
Policy matched on one of the IPs contained in the answer
Policy matched on the name of one nameserver involved
Policy matched on the IP of one nameserver involved
Used in:
IPv4 (RFC 791)
IPv6 (RFC 2460)
Used in:
User Datagram Protocol (RFC 768)
Transmission Control Protocol (RFC 793)
DNS over TLS (RFC 7858)
DNS over HTTPS (RFC 8484)
DNSCrypt over UDP (https://dnscrypt.info/protocol)
DNSCrypt over TCP (https://dnscrypt.info/protocol)
DNS over QUIC (RFC 9250)
Used in:
Query received by the service
Response returned by the service
Query sent out by the service to a remote server
Response returned by the remote server
Used in: