# Questions about dns.log **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [November 29, 2011, 4:16pm UTC](https://community.zeek.org/t/questions-about-dns-log/2125 "2011-11-29T16:16:19Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [November 29, 2011, 4:16pm UTC](https://community.zeek.org/t/questions-about-dns-log/2125/1 "2011-11-29T16:16:19Z")
Two questions about dns.log: - it logs all the answers for each request but only one TTL. Should "TTL" be a list of all the values in the corresponding order? - it doesn't log the type of the answers (A, MX, etc), which seems   could be helpful? Robin ---
**Author:** ![Slagell\_Adam\_J](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@Slagell\_Adam\_J](https://community.zeek.org/u/Slagell_Adam_J)\ **Post date:** [November 29, 2011, 4:23pm UTC](https://community.zeek.org/t/questions-about-dns-log/2125/2 "2011-11-29T16:23:28Z")
I thought that was odd myself going through and testing traces. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [November 29, 2011, 5:41pm UTC](https://community.zeek.org/t/questions-about-dns-log/2125/3 "2011-11-29T17:41:00Z")
I haven't ever really been satisfied with the content of that log. It's really hard to represent the DNS request/response pair though considering that you have to weigh data volume with typical use cases. It seems that all most people want (from a security forensics perspective) are the answers that came back from queries and who made the query. The technical details (even response type) matter surprisingly little in most cases. I would definitely like to talk about it more though.   .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [November 29, 2011, 5:45pm UTC](https://community.zeek.org/t/questions-about-dns-log/2125/4 "2011-11-29T17:45:31Z")
> the query. The technical details (even response type) matter > surprisingly little in most cases. Maybe, but right now at least the TTL is just misleading/confusing I think as it's not clear what it belongs to. > I would definitely like to talk about it more though. We can do that. 🙂 Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/questions-about-dns-log/2125/5 "2022-05-06T15:40:00Z")