本頁面針對 Cloud DNS 的記錄和監控指標提供相關說明，包括 公開區域、
私人區域、 和轉送區域 。此外，本頁面也提供監控公開 DNS 變更傳播的操作指示。
使用 Cloud DNS 記錄
Cloud DNS 記錄會追蹤名稱伺服器為虛擬私有雲 (VPC) 網路解析的查詢，以及外部實體直接向公開區域發出的查詢。
記錄下來的查詢可能來自 Compute Engine 虛擬機器 (VM) 執行個體、相同虛擬私有雲網路內的 Google Kubernetes Engine 容器、對等互連區域，或使用傳入 DNS 轉送的內部部署用戶端。這些查詢最後可能會由私人 DNS 區域、轉送 DNS 區域、備用名稱伺服器、內部Google Cloud DNS 區域或外部 DNS 區域解析。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eCloud DNS logging tracks queries resolved by name servers for your VPC networks and external entities directly querying a public zone, including queries from Compute Engine VMs, Google Kubernetes Engine containers, peering zones, or on-premises clients.\u003c/p\u003e\n"],["\u003cp\u003eLogging can be enabled or disabled for private managed zones using DNS policies through the \u003ccode\u003egcloud dns policies\u003c/code\u003e command with options to create, update, or delete them.\u003c/p\u003e\n"],["\u003cp\u003eLogging for public managed zones can be enabled or disabled with the \u003ccode\u003egcloud dns managed-zones update\u003c/code\u003e command, using either the \u003ccode\u003e--log-dns-queries\u003c/code\u003e or \u003ccode\u003e--no-log-dns-queries\u003c/code\u003e flags.\u003c/p\u003e\n"],["\u003cp\u003eEvery log entry in Cloud DNS has various fields like \u003ccode\u003esource_type\u003c/code\u003e, \u003ccode\u003elocation\u003c/code\u003e, \u003ccode\u003eproject_id\u003c/code\u003e, \u003ccode\u003etarget_type\u003c/code\u003e, \u003ccode\u003equeryName\u003c/code\u003e, and more, which can be used in metrics and provide detailed information about the DNS query.\u003c/p\u003e\n"],["\u003cp\u003eYou can monitor DNS propagation using \u003ccode\u003egcloud\u003c/code\u003e commands to check the status of changes and \u003ccode\u003edig\u003c/code\u003e commands to verify name server updates, allowing you to track when new records are available.\u003c/p\u003e\n"]]],[],null,["# Use logging and monitoring\n\nThis page provides information about logging and monitoring metrics for\nCloud DNS including [public zones](/dns/docs/dns-overview#public_zone),\n[private zones](/dns/docs/overview#private_zone), and\n[forwarding zones](/dns/docs/zones/zones-overview#forwarding_zones). This page also\nprovides instructions for monitoring the propagation of your public DNS changes.\n\nUse Cloud DNS logging\n---------------------\n\nCloud DNS logging tracks queries that name servers resolve for your\nVirtual Private Cloud (VPC) networks, as well as queries from an external entity\ndirectly to a public zone.\n\nLogged queries can come from Compute Engine virtual machine (VM) instances,\nGoogle Kubernetes Engine containers in the same VPC network,\n[peering zones](/dns/docs/zones/zones-overview#peering_zones), or\non-premises clients that use [inbound DNS\nforwarding](/dns/docs/server-policies-overview#dns-server-policy-in).\nPrivate DNS zones, forwarding DNS zones, alternative name servers, internal\nGoogle Cloud DNS zones, or external DNS zones might eventually resolve\nthe queries.\n\nLog records belong to the project that owns the network or public zone that\ncarried the request. In the case of [Shared VPC](/vpc/docs/shared-vpc),\nthe log records belong to the host project because the host project owns the\nnetwork.\n| **Note:** Cloud DNS might respond to queries using cached responses. By default, cached responses are not logged. However, if logging is enabled, at least one prior response is logged before any subsequent cached response is served without logging.\n\n### Enable and disable logging for private managed zones\n\nUse DNS policies to enable or disable logging for your networks. When you enable\nquery logging, every DNS query to a Cloud DNS private\nmanaged zone is logged.\n\nTo enable logging for a network that does not have a DNS policy, run the\n[`dns policies create`](/sdk/gcloud/reference/dns/policies/create) command. \n\n### gcloud\n\n```\ngcloud dns policies create POLICY_NAME \\\n --networks=NETWORK \\\n --enable-logging \\\n --description=DESCRIPTION\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the name of the DNS policy\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: one or more networks in a comma-separated list\n- \u003cvar translate=\"no\"\u003eDESCRIPTION\u003c/var\u003e: a description of the policy\n\nTo enable logging for a network that has an existing DNS policy, run the\n[`dns policies update`](/sdk/gcloud/reference/dns/policies/update) command. \n\n### gcloud\n\n```\ngcloud dns policies update POLICY_NAME \\\n --networks=NETWORK \\\n --enable-logging\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the name of the DNS policy\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: one or more networks in a comma-separated list\n\nTo turn off logging while leaving the policy in place, run the\n[`dns policies update`](/sdk/gcloud/reference/dns/policies/update) command. \n\n### gcloud\n\n```\ngcloud dns policies update POLICY_NAME \\\n --networks=NETWORK \\\n --no-enable-logging\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the name of the DNS policy\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: one or more networks in a comma-separated list\n\nTo delete the policy entirely, run the\n[`dns policies delete`](/sdk/gcloud/reference/dns/policies/delete) command. \n\n### gcloud\n\n```\ngcloud dns policies delete POLICY_NAME \\\n```\n\nReplace \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e with the name of the DNS policy that\nyou want to delete.\n\n### Enable and disable logging for managed public zones\n\nTo turn on logging for an existing managed public zone, run the\n[`dns managed-zones update`](/sdk/gcloud/reference/dns/managed-zones/update) command. \n\n### gcloud\n\n```\ngcloud dns managed-zones update ZONE_NAME --log-dns-queries \\\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e with the name of the DNS managed zone that\nyou want to enable logging for.\n\nTo turn off logging for an existing public managed zone, run the\n[`dns managed-zones update`](/sdk/gcloud/reference/dns/managed-zones/update) command. \n\n### gcloud\n\n```\ngcloud dns managed-zones update ZONE_NAME --no-log-dns-queries \\\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e with the name of the DNS managed zone that\nyou want to disable logging for.\n\n### View logs\n\nYou can view logs in the Google Cloud console. \n\n### Console\n\nIn the Google Cloud console, go to the **Logs Explorer** page.\n\n[Go to Logs Explorer](https://console.cloud.google.com/logs/viewer?resource=dns_query)\n\n#### View record format fields\n\nEvery log entry has the following fields, if applicable. Some of the fields are\nalso shared with monitoring metrics.\n\nPricing\n-------\n\nAll Cloud DNS logs are written to Cloud Logging. There is no\nseparate charge from Cloud DNS for this service. However, these logs\ncan result in additional storage costs depending on the size of the logs that are\nwritten and stored.\n\nFor calculation purposes, Cloud DNS writes approximately 5 MB of log\ndata for processing 10,000 DNS queries.\n\nFor information about Cloud Logging pricing, see\n[Pricing for Google Cloud Observability: Cloud Logging](/stackdriver/pricing).\n\nTroubleshoot outbound forwarding\n--------------------------------\n\nIf you receive logs containing `SERVFAIL` that are missing certain fields\nsuch as `destinationIP`, `egressIP`, and `egressError`, see the\n[related section in the Troubleshooting documentation](/dns/docs/troubleshooting#outbound-forwarded-queries-receive-servfail-errors).\n\nMonitor metrics\n---------------\n\nCloud DNS exports monitoring metrics to\n[Cloud Monitoring](/monitoring/docs/monitoring-overview).\n\nYou can monitor the rate of DNS queries and responses that point to private\nzones, forwarding zones, policy forwarding, internal Google Cloud zones,\nand the internet. Monitoring is available on the Google Cloud console\n[Monitoring page](https://console.cloud.google.com/monitoring)\nand in the\n[Cloud Monitoring API](/monitoring/api/v3).\n\nPrivate DNS exports the `dns.googleapis.com/query/response_count` delta metric\nthat contains the `response_code` label to count the number of queries per\nresponse code.\n\nThe `response_code` label is of type `string` with the possible values of\n`NOERROR`, `FORMERR`, `SERVFAIL`, `NXDOMAIN`, `NOTIMP`, and `UNKNOWN`.\nFor definitions of these codes, see the\n[IANA DNS RCODEs](https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6).\n\nThe metric is exported under the `dns_query` resource type by using the\napplicable fields of the log\n[record format](#dns-log-record-format).\n\nMonitor DNS propagation\n-----------------------\n\nWhen you use the Google Cloud CLI or the REST API to make changes, the changes are\ninitially marked as pending until the operation is completed. You can\nuse the gcloud CLI or the REST API to check on the status of changes\nor get a history of changes.\n\nAn operation is completed (status: `done`) when Cloud DNS has\nsuccessfully updated the system that controls the servers. There might still\nbe delays before all name servers are updated.\n\n### List changes for a managed zone\n\nTo list changes for a managed zone, run the [`dns record-sets changes list`](/sdk/gcloud/reference/dns/record-sets/changes/list) command. \n\n### gcloud\n\n```\ngcloud dns record-sets changes list --zone=ZONE\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE\u003c/var\u003e with the name of the managed zone whose\nrecord sets you want to manage.\n\n### Verify DNS propagation\n\nTo monitor and verify that the DNS name server has picked up your changes, you\ncan use the `watch` and `dig` commands. The following example demonstrates how\nto look up your name server and check to see when one of your managed zone's\nname servers has picked up a change to an `MX` record.\n| **Note:** The commands `watch` and `dig` are provided by the Linux operating system and are not `gcloud` commands. As such, they don't require the `gcloud` prefix to run. For other operating systems, you might have to install the commands.\n\nTo look up your zone's name servers, run the\n[`dns managed-zones describe`](/sdk/gcloud/reference/dns/managed-zones/describe)\ncommand: \n\n### gcloud\n\n```\ngcloud dns managed-zones describe ZONE_NAME\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE_NAME\u003c/var\u003e with the name of your Cloud DNS\nzone.\n\nTo check if the records are available yet on your authoritative name server,\nrun the following `dig` command: \n\n### gcloud\n\n```\nwatch dig example.com in MX @ZONE_NAME_SERVER\n```\n\nReplace \u003cvar translate=\"no\"\u003eZONE_NAME_SERVER\u003c/var\u003e with one of the name servers from\nthe managed zone.\n\nThe `watch` command runs the `dig` command every 2 seconds by default. You\ncan use this command to determine when your authoritative name server picks up\nyour change, which should happen within 120 seconds. After your authoritative\nname server has the change, DNS resolvers can start to pick up the new record.\nResolvers that already have the previous record cached wait for the\nprevious TTL value of the record to expire.\n\nTo run `dig` against your system's name server, you can remove the `@\u003caddress\u003e`\nfrom the `dig` command. If you would like to monitor propagation to other name\nservers, you can change the `address` to point to other name servers.\n\nWhat's next\n-----------\n\n- To add, delete, and update records, see [Add, modify, and delete records](/dns/docs/records).\n- To create, update, list, and delete managed zones, see [Managing zones](/dns/docs/zones).\n- To find solutions for common issues that you might encounter when using Cloud DNS, see [Troubleshooting](/dns/docs/troubleshooting).\n- To reference the API, see [Cloud DNS REST API](/dns/docs/reference/v1).\n- To get an overview of Cloud DNS, see [Cloud DNS overview](/dns/docs/overview)."]]
