Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. dns
  5. dns.log
LogRisk: Caution
  • Windows Server

dns.log C:\Windows\System32\dns\dns.log

Windows DNS server debug log (dns.log), disabled by default, tracing packets and queries according to the selected options.

Updated on By AltF4 Formation

What it’s for

dns.log is the Windows DNS server’s debug log. It shows exactly what the server receives and sends: queries, responses, dynamic updates, zone transfers. It is off by default and remains a troubleshooting tool, not permanent monitoring.

What it contains

Depending on the debug options chosen (packet direction, protocol, packet type, address filters), one line per logged DNS packet: date, time, direction (send or receive), remote address, query type and queried name. On a busy server the file quickly gets large.

Risks and best practices

  • Enable it only for the duration of the diagnosis, with filters (source IP address, packet type) to limit volume, and set a maximum size so the disk does not fill up.
  • It reveals the names clients look up, which is a privacy and security matter. Restrict access and delete copies after use.
  • For permanent tracing, prefer the DNS server audit and analytical logs.
  • Disable logging before deleting the file.

Useful commands

Fenêtre de terminal
# Current diagnostic settings (as administrator)
Get-DnsServerDiagnostics | Select-Object EnableLoggingToFile, LogFilePath, MaxMBFileSize


# Turn on logging of queries received over UDP (turn it off afterwards)
Set-DnsServerDiagnostics -EnableLoggingToFile $true -Queries $true -Receive $true -UdpPackets $true


# Last lines of the log
Get-Content -Path "$env:windir\System32\dns\dns.log" -Tail 50


# Search for a domain name
Select-String -Path "$env:windir\System32\dns\dns.log" -Pattern 'example.local'

Format

Plain text, with a header recalling the active logging options, followed by one line per packet.

Rotation and archiving

Maximum size and location are set with Set-DnsServerDiagnostics (-MaxMBFileSize and -LogFilePath parameters) or in the DNS console, on the “Debug Logging” tab. Archive a copy before reducing the size or turning logging off.

How to read it

Read the legend in the file header: packet direction and type appear on each line. To look for a name or an address, use Select-String as above.

Report a mistake