BIND 9.3.1rc1 Query Log Format

Martin Lie martin.lie at
Wed Mar 2 19:30:21 UTC 2005

Alan Shackelford wrote:
> These are from my external DNS server(s), and I am curious what the -E
> represents. I also have quite a few ending in - and a few ending in
> +. What is being said here?

Quoting Jim Reid's mail from Feb 22nd, explaining the query log format:

> The entries should be clear enough: the date and time the query was
> received; the source IP address and port number used by the client;
> and the name, class and qtype. The final field shows if the query had
> the rd (recursion desired) bit set (+) or not (-) -- typically showing
> if the query came from a name server or stub resolver -- or if EDNS0
> (E) was used.

EDNS0 is explained in RFC2671:

Martin Lie

More information about the bind-users mailing list