DNS log messages on FAZ

[lots_of_questions_Pe]

Hello All,

Im hoping someone can help me understand what im seeing in the DNS security logs on FAZ for my Fortigate.

the network is set up to use internal DNS servers for 90% of traffic that point to 8.8.8.8 and 8.8.4.4 and guest network uses 8.8.8.8 and 8.8.4.4 directly.

what i am trying to understand is, is the destination IP on the log entry the DNS server address or is it the A-record of the domain name.

On the face of it this seems like a very simple and possibly silly question however when reviewing the logs I see the destination IP address is sometimes as a DNS server like 8.8.8.8 and sometimes a random address that does not always belong to the organization that the domain name belongs to. If the destination address should be the DNS server then it should always be either 8.8.8.8 or 8.8.4.4 and if it is the A-record then it should almost never be 8.8.8.8.

I feel quite confused by this.

[image][/image]

many thanks in advance for any help that can be provided on this subject.

Kind regards