Query insights
Every zone has an Insights tab showing what the internet is actually asking it. Volume over time, which names and record types are being queried, which resolvers are asking, where they are, how fast you answered, and a live feed of individual queries.
Where to find it
console.dnswiz.app → a zone → Insights.
The page refreshes itself every 30 seconds. The window picker at the top
(1h, 24h, 7d, 30d) applies to every card except Top queriers
and Recent queries, which are explained below.
The window picker and the trend chip
Next to the total is a trend chip comparing this window against the one
before it. It only appears once the previous window saw at least 50
queries. Below that the percentage swings wildly on a handful of
requests and means nothing, so you get a trend: low data chip instead.
Windows up to 7 days read from hourly tables; 30 days reads from daily rollups. Hourly data is kept for 30 days, daily rollups for one year.
The cards
Queries over time: volume per bucket across the window.
By query type: A, AAAA, MX, TXT and friends, as a share of total.
By country: where queries came from, resolved from the source address at the edge.
By response code: NOERROR, NXDOMAIN, REFUSED, SERVFAIL. A rising NXDOMAIN share usually means something is asking for names you don’t have; a rising REFUSED share means your query firewall is doing work.
Top names: which names in the zone are actually being asked for. Useful for spotting records nobody queries, and for finding the one name carrying all your traffic.
Top queriers: the source addresses hitting the zone hardest, with a country flag. See the caveats below.
Answer latency: p50, p95 and p99 in microseconds, plus the full distribution. p95 needs at least 20 samples in the window and p99 needs 100 before either is shown; below that the estimate is noise. These measure the engine’s own answer time, not what the client experienced. Network time is not included.
Refused queries: the most recent queries your firewall turned away. For the full forensics view see Refused-query forensics.
Recent queries
The strip at the bottom is a live sample of individual queries: time, source address with country flag, name, type, response code, country.
Two things to know about it:
- It holds the last 200 queries per zone, which in practice is the last few minutes on a busy zone and rather longer on a quiet one.
- It lives in memory, not in the database. It empties when the API restarts, and it is not affected by the window picker.
Click any slice on the query-type, country, response-code or top-querier cards to filter this feed to just those queries. Click the same slice again, or the chip in the feed header, to clear it.
Top queriers, and what the numbers mean
This card answers “who is hammering me right now”. It does not answer “how many queries has this client ever sent”, and it is worth being precise about why:
- It covers a rolling 10-minute window, not the window picker. Source addresses are never written to the database (see below), so there is no history to look back over.
- It is a sample of the heaviest talkers, not a complete census. Each edge reports only its busiest sources on each flush, so a client making a handful of queries may not appear at all. Treat the counts as “at least this many”, and use the shape rather than the absolute number.
- Like the recent feed, it empties when the API restarts.
Source addresses and privacy
Source addresses are the most sensitive thing the query path sees, so they are handled differently from every other number on this page.
They are held in memory only, for about ten minutes, and are never written to Postgres. That means they are not in your backups, they do not accumulate over time, and there is no address-shaped column to export or erase. The trade-off is the one described above: recent activity, not history.
Between the edge and the control plane, addresses travel encrypted
whenever both are configured with the shared DNSWIZ_DNSSEC_KEY, the
same key used for DNSSEC signing and refused-query
forensics.
If the source column and the Top queriers card stay empty while queries are clearly arriving, the usual cause is that your edge is encrypting with a key the control plane does not have. Both sides log a warning at startup saying so. An edge and a control plane that both run without the key work fine, the addresses simply travel unencrypted on the internal bus.
What is not here
-
Per-record query counts live on the records list itself, as a
N / 24hbadge next to each record, rather than on this tab. -
Firewall rule hits are on the forensics view.
-
Insights count only queries for zones dnswiz serves authoritatively. Malformed queries, and queries for names in zones you do not own, are not attributed to any tenant, so they never reach this tab.
A query your own firewall refuses is counted, and shows up as
REFUSEDin the response-code card and in the recent feed. That is the distinction worth holding on to: refusals by your rules are your traffic, refusals because the name isn’t yours are not.