What a DNS Log Actually Contains, and Why It Matters

TL;DR: A DNS log is a record of every domain your household asked about. Standard ISP DNS keeps one by default, which amounts to a lifelong diary of everywhere you and your family have been online. Whether a resolver writes that diary, who can read it, and how long it lives are three separate questions, and a provider should answer all three plainly.

The diary you didn't know you were writing

Suppose every time you opened a door in your house, someone wrote it down. Bedroom at 7:04. Bathroom at 7:11. Kitchen at 7:22. Front door at 7:58 with a bag.

Now picture that diary on a server in a data center owned by a company that sells advertising. It has been running for the entire time you've owned the house.

That's what standard DNS is. Every google.com, every pornhub.com, every alcoholics-anonymous.org, every whattexpect.com your family's phones and laptops ever looked up: it's written down somewhere. Usually by your ISP. Sometimes by "free" DNS providers who monetize the stream.

The opposite arrangement is a resolver that answers and forgets. It sees the question, answers it, and keeps nothing. There is no diary, and so there is nothing to subpoena, sell, leak, or re-identify.

This post explains what a DNS log actually contains, why it is more revealing than people realise, and what to ask a provider before you trust theirs.

What "we do not log" is supposed to mean

The strong version is a resolver that processes queries entirely in volatile memory and never writes them to persistent storage. No query log, no client IP log, no access log tied to individual lookups. When the CPU is done answering your question, the memory holding it is reused for someone else's question, and your question is gone.

Be careful with the phrase itself. "Zero-log" is used loosely enough to be close to meaningless: some providers mean no logs at all, some mean no logs tied to your identity, some mean no logs after 24 hours. It is a marketing term, not a technical one, and a provider using it without further detail has told you nothing. Ask instead what is written, where, for how long, and who can read it.

Contrast that with a "privacy-friendly" DNS service that aggregates or anonymizes logs. Those services still write the data to disk first and then try to scrub it afterward. Scrubbing is fallible. Aggregation can be reversed with cross-referencing. A breach of the raw logs exposes everyone who used the service before the scrub ran.

Keeping nothing is stronger because the weakest link, the disk, is never involved.

What a DNS log actually contains

A standard DNS log entry looks roughly like this:

2026-04-19T14:22:17Z  203.0.113.42  A  pornhub.com   NOERROR
2026-04-19T14:22:19Z  203.0.113.42  A  instagram.com NOERROR
2026-04-19T14:23:01Z  203.0.113.42  A  bankofamerica.com NOERROR

Four fields: time, your IP address, the record type, the domain, the result.

String enough of these together and you have:

• Every news site someone in the house reads
• Every brand they shop
• Every medical symptom they Googled
• Every dating app, porn site, or religious organization they visit
• The exact time each family member wakes up, leaves for school, and comes home (because phones start resolving)

This is not theoretical. This is what's in your ISP's logs right now, for the past 6 to 24 months depending on your country's retention law. And it's what's in the logs of "free" DNS services that haven't published a clear no-retention policy.

DNS logs are, pound for pound, one of the most revealing surveillance datasets that exist. In many ways they're more revealing than location history: location tells you where, but DNS tells you what you were thinking about when you got there.

How a resolver avoids writing anything (briefly)

A resolver that keeps nothing is engineered so that:

1. Queries arrive over DoH/DoT (encrypted transport) and are decrypted into RAM.
2. The blocklist lookup and cache check happen in RAM.
3. The upstream query (if needed) and response happen in RAM.
4. The answer is sent back.
5. The memory page is reused, overwriting the data within microseconds.
6. No write to disk, S3, Kinesis, Kafka, Splunk, Datadog, or anywhere else.

Metrics can still be collected, but only as aggregate counters (total queries per second, cache hit rate, error rate). No per-query data ever leaves the process.

That is the engineering. The harder part is cultural: you have to resist every product manager who wants "just a tiny sample log for debugging." Once you start writing queries down, the promise is a different and weaker one, and it should be described differently.

Why it matters for families

Most parents think of DNS as a technical detail. It is, right up until the moment it's not.

Your teenager researched something they're scared to ask you about. Maybe it's sexual health, an eating disorder helpline, or a support group for kids of immigrants. That search, the specific domain they visited, is in a log somewhere, tied to your home IP. How long does it stay? Who has access?

Your spouse is going through something private. Grief, addiction recovery, a medical diagnosis, job hunting in secret. Every one of those is a trail of DNS queries. If those logs are kept, they're part of your household's permanent record.

You're using parental controls to protect your kids. It would be deeply ironic if the tool that blocks adult content also kept a forever-log of every site your kids tried to visit. That log becomes a liability the moment it exists: a breach, a subpoena, or a curious employee is all it takes.

Data minimization eases all three problems the same way: by collecting as little as possible, keeping it only briefly, never selling it, and putting deletion in your hands.

Common misconceptions

Myth 1: "If you have nothing to hide, logs don't matter." Privacy is about proportionality, not hiding. Your family does not owe a tech company a minute-by-minute record of their inner life in exchange for DNS service.

Myth 2: "Logs are needed for security." They help detect attacks, yes. But aggregate counters (how many queries per second to a suspicious domain) are enough for abuse detection; you don't need per-user logs to know a DDoS is happening.

Myth 3: "A privacy promise is just a marketing term." It can be, which is why what matters is a concrete, written posture: a clear, written retention window and the ability to delete your data, a commitment to record domains rather than full URLs, and a promise never to sell or share your data. Vague slogans aren't enough; specifics are.

Myth 4: "My ISP doesn't keep logs." Call and ask. In the US, UK, EU, Turkey, and most developed countries, ISPs are legally required to retain connection metadata, often for 12 to 24 months. "Not keeping logs" is not on the menu.

Myth 5: "Filtering requires logging." No. A blocklist decision is made in microseconds from RAM. Logging the decision afterward is a separate choice, and a provider can decline to make it without giving up any filtering.

How Guardino does it

Guardino is built around data minimization. Queries arrive encrypted via DoH (the DoH URL carries a per-profile token in its path) and the blocklist lookup happens in memory before the response goes out the door. Guardino sees the domain, not the full URL or the contents of any page. What it keeps is deliberately small: the domain, whether it was allowed or blocked, the category, and a timestamp, retained 30 days on Free once you turn logging on, and deletable on request any time. Your device IP isn't kept in long-term storage, and query data is never sold or shared with advertisers.

Because filtering is enforced at the resolver, your protections work on any device through encrypted DNS configured once per profile, with no native app to install. The setup flow generates an iOS configuration profile and an Android QR code so you can get going quickly; DoT and Android Private DNS use the bare resolver hostname (dns1.guardino.ai), while DoH carries the profile token. Guardino is registered in Wyoming, USA, and honors your GDPR and KVKK rights as described in our privacy policy. The free tier covers one profile and three devices.

Frequently asked questions

What is a DNS log? A DNS log records every domain name your devices asked about, along with your IP, device identifier, and timestamp. Over time it reveals where you live, what you buy, what you read, what you believe.

Does my ISP log my DNS queries? Almost certainly yes. In many countries ISPs are legally required to retain DNS and connection metadata for 6 to 24 months.

Can a DNS filter block content while keeping little? Yes. Filtering is a fast decision made in memory and does not require keeping a permanent per-query diary. Guardino retains nothing per query until you turn logging on, and then only minimal metadata (the domain, allowed/blocked, category, timestamp) for 30 days on Free. You control it.

How is data minimization different from anonymized logs? Anonymized logs often keep the full record and just truncate your IP afterward. Data minimization decides up front what is never collected: Guardino records domains, not full URLs, and doesn't keep your device IP in long-term storage.

How can I judge whether a provider respects my privacy? A public privacy policy with a clear, written retention window and the ability to delete your data, a posture that records domains rather than full URLs, a clear promise never to sell or share your data, and controls that let you manage your own data.

If you want to see how a provider should describe that posture in the first place, our transparency page sets out the same specifics in one place.

Further reading

• How DNS Filtering Works: A Parent's Guide in Plain English
• DoH vs DoT vs Classic DNS: What Your Router Should Use in 2026
• Product: Privacy Policy · Security

External references:

• EFF: DNS Security
• Mozilla: DNS over HTTPS trusted resolvers
• RFC 8484: DNS Queries over HTTPS (DoH)
• GDPR Article 5: data minimization principles

Ready for a DNS that keeps less?

The best diary is the short one you control. Start Guardino free: set up encrypted DNS once per profile, pick your protections, and let your family browse with domains recorded briefly, never sold, and yours to delete.

Start Free · Privacy by Design →