{"id":7984,"date":"2026-10-15T12:13:58","date_gmt":"2026-10-15T09:13:58","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=support_article&p=7984"},"modified":"2026-10-15T12:13:58","modified_gmt":"2026-10-15T09:13:58","slug":"how-to-check-which-host-is-making-a-dns-query-to-a-malicious-url-when-server-security-is-installed-on-a-domain-controller","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fi\/support-articles\/how-to-check-which-host-is-making-a-dns-query-to-a-malicious-url-when-server-security-is-installed-on-a-domain-controller\/","title":{"rendered":"How to check which host is making a DNS query to a malicious URL when Server Security is installed on a Domain Controller"},"content":{"rendered":"

Issue:<\/h3>\n

When Server Security is installed on a Domain Controller and a DNS query to a harmful \/ malicious URL is blocked, an alert is sent to the Policy Manager Console's Alerts <\/strong>tab which shows the URL that was blocked but not any details which device sent the DNS query.\u00a0<\/p>\n

How to find out which host is making a DNS query to a malicious URL when Server Security is installed on a Domain Controller<\/p>\n

Example alert:<\/p>\n

Warning: A DNS query was blocked for a domain.<\/em>
From: Root\/XXXX.XXX:XX\/Domain Controllers\/XXXXX, 2020-03-10 10:14:06 +00:00<\/em>
Details: A DNS query was blocked for a domain. DNS: example.exampledomain.com.<\/em><\/p>\n

Resolution:<\/h3>\n

Since the DNS query is blocked by the Server Security that is installed on the Domain Controller, only the server is shown as the source for the alert. Server Security cannot know which device is making the query, so you will need to check the DNS logs on the server.\u00a0<\/p>\n

That warning doesn't tell the host, which is making the query. It needs to be checked from the DNS server logs.<\/p>\n

Instructions how to enable DNS server debug logging:<\/p>\n

https:\/\/superuser.com\/questions\/1229515\/windows-dns-server-how-to-find-out-who-made-a-query<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

When Server Security is installed on a Domain Controller and a DNS query to a harmful \/ malicious URL is blocked, an alert is sent to the Policy Manager Console’s Alerts tab which shows the URL that was blocked but not any details which device sent the DNS query.\u00a0<\/p>\n

How to find out which host is making a DNS query to a malicious URL when Server Security is installed on a Domain Controller<\/p>\n

Example alert:<\/p>\n

Warning: A DNS query was blocked for a domain.
\nFrom: Root\/XXXX.XXX:XX\/Domain Controll<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-7984","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000005491","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-15 09:13:58","import_hash":"f307953dc1b6de675670a19370e6f83b8ddf152f","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article\/7984","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/media?parent=7984"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article_product?post=7984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}