DNS Analytics

Available on: Pro Elite

1. What This Feature Does

DNS Analytics is a dashboard that shows how your DNS domains are being queried: how much traffic they receive, where it comes from, what is being asked for, and how healthy the responses are. The revamped dashboard brings together volume trends, geographic and network breakdowns, query-type mix, and security and protocol posture in one place. Every DNS query is logged with the query name, query type (A, AAAA, MX, TXT, etc.), client IP, country code, ASN, response code, timestamp, and response time.

The dashboard surfaces:

KPI cards for queries over the last 24h, 7d, and 30d plus average response time, each with a sparkline and a trend compared to the prior week.
Query-volume trend as a 30-day area chart.
Query origins on a world map by country, alongside a top-countries list.
Query types as a donut chart (A / AAAA / MX / TXT / CNAME / NS / ...).
Security & protocol posture strip: DNSSEC %, IPv6 (AAAA) %, EDNS %, TCP-fallback %, and p95 / p99 latency.
Top NXDOMAIN names (failed lookups) as a security signal.
Response health: NOERROR / NXDOMAIN / SERVFAIL / REFUSED counts and overall error rate.
Top hostnames, top networks (by ASN), and top resolvers.
A health signal banner that flags an unusual drop or spike in query volume versus the weekly average.

DNS Analytics requires a Pro or Elite plan. Free and Plus accounts do not get the analytics dashboard. The dashboard is rollup-driven: figures are aggregated from query logs on an hourly and daily basis, so it is near-real-time rather than instantaneous. The Top NXDOMAIN names and recent-queries views read more current raw data.

2. When You Should Use It

You want to understand how often your DNS domains are being queried and detect traffic patterns over 24h, 7d, and 30d.
You need to identify which countries, networks (ASNs), or resolvers are querying your domains for security or compliance analysis.
You are investigating DNS-based attacks (amplification, enumeration) or abnormal query volume, including unexpected spikes or drops flagged by the health signal banner.
You need to monitor response times (including p95 / p99 latency) to diagnose DNS performance issues.
You want to analyze query type distribution (A vs AAAA vs MX vs TXT vs ...) to optimize DNS configurations.
You want to track protocol posture (DNSSEC, IPv6/AAAA, EDNS, TCP-fallback) and response health (NXDOMAIN, SERVFAIL, REFUSED, error rate).
You want to spot failed lookups via Top NXDOMAIN names — typos, dangling records, or scanning activity.
You need to export historical query data for auditing or compliance reporting (Elite plan).

3. When You Should Not Use It

Application-level monitoring: DNS Analytics tracks DNS queries only. For monitoring HTTP uptime or application availability, use Uptime Monitoring.
Zone-level DNS management: For managing DNS records and zone configurations, use Managed DNS Zones.
Real-time alerting: DNS Analytics provides historical and near-real-time data. It does not trigger alerts or notifications based on query volume thresholds.
Detailed packet inspection: The feature logs query metadata (name, type, source IP, country) but does not capture full DNS packet payloads.

4. Prerequisites

A registered CertaDNS account with a verified email address.
At least one active DNS domain created under your account.
A Pro or Elite plan. The analytics dashboard is not available on Free or Plus plans.
For data export: Elite plan.
Query data begins accumulating after domains are created. Historical data prior to domain creation is not available.

5. How It Works (Brief)

When a DNS query reaches CertaDNS's authoritative nameservers (PowerDNS), the query metadata is logged asynchronously to a PostgreSQL database. Each query record includes the domain name, query type, client IP, country code (resolved via MaxMind GeoIP), autonomous system number (ASN), response code, response time, and timestamp.

Data is stored in monthly partitioned tables (dns_queries_{YYYY}_{MM}). Aggregation jobs roll raw queries up into hourly and daily statistics tables on a schedule. Most of the dashboard — KPI cards, the 30-day trend chart, country/network/resolver breakdowns, query-type mix, response health, and the protocol-posture strip — reads from these rollups, so the figures are near-real-time rather than instantaneous. The Top NXDOMAIN names and recent-queries views read more current raw data from the current month's partition.

The KPI cards and the health signal banner compare the current period against the prior week. The trend is classified as "up" (more queries), "down" (fewer queries), or "stable" (similar volume within a threshold), and an unusual drop or spike versus the weekly average raises the health banner. Trend percentage indicates the magnitude of change.

6. How to Use It

Viewing the analytics dashboard (Pro/Elite)

Navigate to Dashboard > Analytics.
The KPI cards at the top show queries (24h), queries (7d), queries (30d), and average response time. Each card carries a sparkline and a trend versus the prior week.
If query volume has dropped or spiked unusually versus the weekly average, a health signal banner appears at the top of the page.
Below the KPI cards, the query-volume trend area chart plots the last 30 days.

Viewing query origins

The world map shades countries by query volume; hover a country to see its count.
A Top Countries list sits alongside the map, each entry showing a flag emoji (from the ISO country code), country name, and query count.

Viewing query types

The query-types donut breaks down traffic by record type (A / AAAA / MX / TXT / CNAME / NS / ...).
Hover a segment to see the exact count and share of total queries.

Viewing security & protocol posture

The Security & protocol posture strip reports DNSSEC %, IPv6 (AAAA) %, EDNS %, TCP-fallback %, and p95 / p99 latency.
Top NXDOMAIN names lists the most frequent failed lookups — useful for spotting typos, dangling records, or scanning activity.
Response health shows NOERROR / NXDOMAIN / SERVFAIL / REFUSED counts and the overall error rate.

Viewing top hostnames, networks, and resolvers

Top Hostnames ranks the most-queried names.
Top Networks ranks source networks by autonomous system number (AS number) and organization.
Top Resolvers ranks the recursive resolvers sending the most queries.

Exporting data (Elite only)

On the Analytics dashboard, click the Export Data button in the top right.
Select the export format: CSV or JSON.
Select the date range for the export.
Click Export. The file downloads to your browser.

Note: Data export is currently a placeholder feature on Elite plans. Full export functionality will be available in a future release.

7. Inputs and Settings

Field	Description	Constraints
Timeframe	Period reflected by the KPI cards and breakdowns.	Queries are surfaced over 24h, 7d, and 30d; the trend chart covers 30 days. Pro/Elite only.
Recent Query Limit	Number of recent queries to display in the recent-queries view.	Minimum: 10. Maximum: 100. Default: 50. Pro/Elite only.
Export Format	File format for exported data (Elite only).	CSV or JSON. CSV is recommended for spreadsheet analysis. JSON is recommended for programmatic processing.
Export Date Range	Start and end dates for exported query data (Elite only).	Maximum range: 90 days. Data is only available from the current and previous month's partitions.

8. Outputs and Results

KPI cards

Card	Description
Queries (24h / 7d / 30d)	Query counts over each window, each with a sparkline and a trend (up / down / stable arrow with percentage) compared to the prior week.
Average Response Time	Average time to process a query, with a sparkline and a prior-week trend.

Health signal banner

Appears when query volume drops or spikes unusually versus the weekly average, indicating traffic that is worth investigating.

Query-volume trend chart

A 30-day area chart of query volume over time.

World map and top countries

A world map shades countries by query volume. The accompanying top-countries list shows, for each country:

Flag emoji (e.g., 🇺🇸 for United States).
Country name in plain text.
Query count as an integer.

Query-types donut

A donut chart of traffic by record type, including A, AAAA, MX, TXT, CNAME, NS, and others.

Security & protocol posture strip

DNSSEC % — share of queries handled with DNSSEC.
IPv6 (AAAA) % — share of AAAA queries.
EDNS % — share of queries using EDNS.
TCP-fallback % — share of queries that fell back to TCP.
p95 / p99 latency — tail response-time percentiles.

Top NXDOMAIN names

The most frequent failed lookups (NXDOMAIN), surfaced as a security signal for typos, dangling records, or scanning. Reads more current raw data than the rollup-driven panels.

Response health

Counts for NOERROR, NXDOMAIN, SERVFAIL, and REFUSED responses, plus the overall error rate.

Top hostnames, networks, and resolvers

Top Hostnames — most-queried names with query counts.
Top Networks — AS number (e.g., AS15169), organization name (e.g., Google LLC), and query count.
Top Resolvers — recursive resolvers sending the most queries, with query counts.

API response example (GET /dns-analytics/summary)

{
  "total_queries_24h": 14523,
  "total_queries_7d": 98765,
  "total_queries_30d": 432100,
  "avg_response_ms": 18.7,
  "query_trend": "up",
  "trend_percent": 12.4,
  "error_rate": 0.041,
  "response_codes": { "NOERROR": 13940, "NXDOMAIN": 512, "SERVFAIL": 61, "REFUSED": 10 },
  "protocol_posture": {
    "dnssec_pct": 88.2,
    "ipv6_pct": 31.6,
    "edns_pct": 94.0,
    "tcp_fallback_pct": 1.3,
    "p95_ms": 42.0,
    "p99_ms": 88.0
  },
  "query_types": [
    { "type": "A", "query_count": 9102 },
    { "type": "AAAA", "query_count": 3120 },
    { "type": "MX", "query_count": 901 }
  ],
  "top_countries": [
    { "country_code": "US", "country_name": "United States", "query_count": 7823 },
    { "country_code": "DE", "country_name": "Germany", "query_count": 3421 }
  ],
  "top_asns": [
    { "asn": "AS15169", "organization": "Google LLC", "query_count": 4521 },
    { "asn": "AS16509", "organization": "Amazon.com, Inc.", "query_count": 3210 }
  ],
  "top_nxdomain": [
    { "qname": "wpad.example.certadns.com", "query_count": 142 }
  ]
}

Recent queries columns

Column	Description
Query Name	The domain name queried (FQDN).
Query Type	DNS record type (A, AAAA, MX, TXT, etc.).
Response Code	DNS response code (NOERROR, NXDOMAIN, SERVFAIL, etc.).
Client IP	Source IP address of the query (IPv4 or IPv6).
Client Country	Country code and flag emoji (e.g., 🇺🇸 US).
Timestamp	Date and time the query was received (UTC).
Response Time	Time in milliseconds to process the query.
Domain	The domain that was queried (for multi-domain accounts).

9. How to Interpret Results

Normal

Total queries increase steadily over time as your domains receive traffic. Trend indicator shows "stable" or modest "up" trend.
Most queries are type A or AAAA, indicating typical hostname lookups.
Top countries reflect the geographic distribution of your user base or service audience.
Response times are under 50ms for most queries, indicating healthy DNS performance.

Unexpected or worth investigating

Sudden spike in total queries: May indicate a traffic surge, DNS amplification attack, or misconfigured client retrying queries rapidly. Check the recent-queries view and the health signal banner for patterns.
High percentage of NXDOMAIN responses: Indicates queries for non-existent subdomains. May be normal (clients probing for subdomains) or abnormal (DNS enumeration attack). Check Top NXDOMAIN names for typos, dangling records, or scanning patterns.
Elevated SERVFAIL or error rate: Review Response health; sustained SERVFAIL can indicate a DNSSEC or backend issue.
Health signal banner fires: An unusual volume drop or spike versus the weekly average. A drop may mean a delegation or client problem; a spike may mean a surge or attack.
Queries from unexpected countries: If your service is region-specific but queries originate from unrelated countries, investigate for unauthorized access or DNS leakage.
Queries for unusual record types (e.g., ANY, AXFR): These query types are often associated with reconnaissance or zone transfer attempts. Review the client IP and ASN for suspicious activity.
Response times consistently above 100ms: May indicate DNS server performance degradation or network latency issues. Contact support if sustained.

Common interpretation mistakes

Confusing query count with unique visitors: DNS queries do not equate to unique users. A single user may generate multiple queries due to DNS caching behavior, retries, or multiple applications querying the same domain.
Expecting analytics on Free or Plus plans: The analytics dashboard is Pro/Elite only. Free and Plus accounts do not get the dashboard at all — there is no summary-totals tier.
Treating the dashboard as instantaneous: Most panels are rollup-driven and near-real-time (aggregated hourly/daily). Only Top NXDOMAIN names and recent queries read more current raw data.
Assuming trend "up" always means growth: A trend "up" indicates more queries than the previous period, but this could be due to abnormal activity (e.g., attack traffic) rather than legitimate growth. Always review the query types and sources.

10. Common Issues and Explanations

"DNS Analytics requires Pro or Elite" error

You are on the Free or Plus plan. The analytics dashboard is available on Pro and Elite plans only; Free and Plus accounts do not get it. Upgrade to Pro or Elite to unlock the dashboard.

"Recent query data requires Pro or Elite" error

The recent-queries view is part of the analytics dashboard and is only available on Pro and Elite plans. Upgrade to access it.

"Data export requires Elite" error

Data export functionality is restricted to Elite plan users. Upgrade to Elite to download historical query data in CSV or JSON format.

"Domain not found" error when accessing domain detail

The domain ID in the URL does not exist or does not belong to your account. Verify the domain still exists in your domain list and that you have not deleted it.

No data displayed for a domain

DNS Analytics only tracks queries received after the feature was enabled for your account. If you recently created a domain or recently upgraded to a Pro/Elite plan, data may not be available yet. Wait for DNS queries to accumulate (typically within a few hours of active use).

Country or ASN data shows "Unknown"

If the client IP cannot be resolved to a country or ASN (e.g., private IP ranges, recent IP allocations not yet in the GeoIP database), the country or ASN will display as "Unknown". This is expected for internal or private network queries.

Trend indicator shows "stable" despite large query count difference

The trend calculation uses a threshold to determine "stable". If the percentage change is below the threshold (e.g., within ±5%), the trend is classified as "stable" even if the absolute query count difference is large. This prevents noise from minor fluctuations.

11. Limits and Constraints

Constraint	Free	Plus	Pro	Elite
Analytics dashboard (KPI cards, trends, breakdowns)	No	No	Yes	Yes
Query-volume trend chart (30d)	No	No	Yes	Yes
World map & top countries	No	No	Yes	Yes
Query-types donut	No	No	Yes	Yes
Security & protocol posture (DNSSEC/IPv6/EDNS/TCP, p95/p99)	No	No	Yes	Yes
Top NXDOMAIN names & response health	No	No	Yes	Yes
Top hostnames / networks (ASN) / resolvers	No	No	Yes	Yes
Recent queries view	No	No	Yes (max 100)	Yes (max 100)
Data export	No	No	No	Yes (placeholder)

DNS Analytics is Pro/Elite only. Free and Plus accounts do not get the dashboard.
Top countries displayed: 10 maximum.
Top networks (ASNs) displayed: 5 maximum.
Recent queries limit: 10 to 100 queries.
Most panels are rollup-driven (aggregated hourly/daily), so figures are near-real-time. Top NXDOMAIN names and recent queries read more current raw data.
Data retention: Query data is stored in monthly partitions. Retention depends on partition lifecycle policy (typically 12 months for active accounts).
Export date range: Maximum 90 days per export (Elite only).
Volume windows: 24h, 7d, 30d; the trend chart covers 30 days. Custom date ranges are not supported.
Recent queries are only retrieved from the current month's partition. Queries older than the current month are not included.

12. Related Features

Dynamic DNS Domains — The domains being queried and tracked by DNS Analytics.
Uptime Monitoring — Monitors domain availability and HTTP/HTTPS uptime (different from DNS query analytics).
Managed DNS Zones — Zone-level DNS management and analytics for imported domains.
DNS Record Management — Create and manage DNS records (A, AAAA, MX, TXT, etc.) for analytics tracking.

13. Updates and Behavior Changes

DNS Analytics is a Pro/Elite feature. Free and Plus accounts do not get the dashboard.
The dashboard was revamped to add KPI cards with sparklines and prior-week trends, a 30-day query-volume trend chart, a world map of query origins, a query-types donut, a security & protocol posture strip (DNSSEC / IPv6 / EDNS / TCP-fallback / p95 / p99), Top NXDOMAIN names, response health, top hostnames / networks / resolvers, and a health signal banner for unusual volume drops or spikes.
Data export was introduced as an Elite-only placeholder feature. Full export functionality will be available in a future update.
Top countries list was expanded from top 5 to top 10 to provide more granular geographic insights.
Query data retention was extended from 30 days to monthly partitions with 12-month retention for active accounts.

1. What This Feature Does

2. When You Should Use It

3. When You Should Not Use It

4. Prerequisites

5. How It Works (Brief)

6. How to Use It

Viewing the analytics dashboard (Pro/Elite)

Viewing query origins

Viewing query types

Viewing security & protocol posture

Viewing top hostnames, networks, and resolvers

Exporting data (Elite only)

7. Inputs and Settings

8. Outputs and Results

KPI cards

Health signal banner

Query-volume trend chart

World map and top countries

Query-types donut

Security & protocol posture strip

Top NXDOMAIN names

Response health

Top hostnames, networks, and resolvers

API response example (GET /dns-analytics/summary)

Recent queries columns

9. How to Interpret Results

Normal

Unexpected or worth investigating

Common interpretation mistakes

10. Common Issues and Explanations

"DNS Analytics requires Pro or Elite" error

"Recent query data requires Pro or Elite" error

"Data export requires Elite" error

"Domain not found" error when accessing domain detail

No data displayed for a domain

Country or ASN data shows "Unknown"

Trend indicator shows "stable" despite large query count difference

11. Limits and Constraints

12. Related Features

13. Updates and Behavior Changes

More in Monitoring & Analytics

Still stuck?