Protective DNS Resolver Log Training Video

Why It Matters

This capability streamlines DNS telemetry ingestion and regular reporting, enabling faster investigative, security and compliance workflows while reducing manual admin effort. Centralized scheduling and auditability improve operational control and evidence retention for security teams.

Summary

Protective DNS’s Resolver Logs feature lets organization users with reporting roles preview, filter, download and schedule full DNS query extracts from the management dashboard. Users can filter by source set, authorized source, policy, record type, name and time range, preview up to 100 records, or schedule full extracts (up to 3,000,000 records) for immediate or recurring delivery. Scheduled extracts include configurable cadence, notifications, edit/delete controls and an extract history that retains records for 72 hours; API-based log push requires a one-time account upgrade coordinated with CISA. The interface provides error handling, duplicate/long-run warnings, sortable result tables and audit logs for tracking events like alerts, user creation and policy changes.

Original Description

CISA’s Protective Domain Name System (#ProtectiveDNS) service delivers greater protection, increased visibility, and enhanced capabilities for federal civilian executive branch agencies and select critical infrastructure partners in our mission to reduce cyber risk.

Watch our newest Protective DNS resolver log training video.

To learn more about Protective DNS, visit CISA.gov or contact [e-mail].