Is there a way to log all queries, even if they don't belong to a zone?

[voltagex]

I would expect dig +trace does.not.exist @my.server to generate a log line in journalctl if I have logging turned on in the Corefile - but I only get an [INFO] log line if the non-existent domain is under one of the domains my server can answer for.

I want to be able to log any strange traffic to drive firewall rules and out of pure interest.

[chrisohaver]

hmm I think you'd have to define a stub server block for . with log in it, and template plugin to provide a canned negative response.

[voltagex]

I'm not sure how to do that if all of my other blocks are listening on specific interfaces.

[chrisohaver]

It would have to explicitly bind to the same interfaces.

[chrisohaver]

... or create a separate . block per bound interface.

[voltagex]

Thank you @chrisohaver, getting closer.

NS IN . gets caught by an ANY ANY template, so dig +trace starts failing.

Config is as follows:

test1.domain.example {
	bind 127.0.0.2
	template ANY A {
		match exists
		answer "IN A 127.0.0.1"
	}
	log {
		class all
	}
}

. {
	bind 127.0.0.2
	template ANY ANY {
		rcode NXDOMAIN
	}
	log {
		class all
	}
}

dig +short exists.test1.domain.example @127.0.0.2
127.0.0.1

dig +trace exists.test1.domain.example @127.0.0.2

; <<>> DiG 9.18.19-1~deb12u1-Debian <<>> +trace exists.test1.domain.example @127.0.0.2
;; global options: +cmd
;; Received 40 bytes from 127.0.0.2#53(127.0.0.2) in 0 ms

#log shows what went wrong
[INFO] 127.0.0.1:54122 - 7151 "NS IN . udp 40 true 1232" NXDOMAIN qr,aa,rd 17 0.000092599s

"NS IN ." is really hard to search for - what should the response to this query be?

[chrisohaver]

could try an empty NOERROR response instead...

	template ANY ANY {
		rcode NOERROR
	}

NOERROR is the default code response, so the following should be equivalent

	template ANY ANY