> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Route 53 DNS Query Logs

> Ingest Amazon Route 53 public DNS query logs and Resolver query logs into Bronto to investigate DNS traffic patterns, resolver failures, and suspicious lookups.

Amazon Route 53 produces two types of query logs with different delivery options and record shapes, so they take different ingestion paths:

* **Resolver query logs** — for resolver endpoints in your VPCs. Can be delivered **directly to Kinesis Data Firehose** (also CloudWatch or S3). Records are **JSON**.
* **Public DNS query logs** — for hosted zones (which queries hit which records). Written to **CloudWatch Logs only**. Records are a **space-delimited line**.

## Recommended method

**Resolver query logs → [Kinesis Firehose](./aws-firehose).** Configure the Resolver query-log configuration to deliver to a Firehose stream. Records arrive as JSON (`query_name`, `query_type`, `rcode`, `answers[]`, `srcaddr`, …) and Bronto parses and flattens them into searchable fields automatically — no parser needed.

**Public zone query logs → [CloudWatch Log Forwarder](./aws-client-cloudwatch).** Public hosted-zone query logging can only be written to CloudWatch Logs; the Bronto forwarder Lambda subscribes to the resulting log group.

<Note>
  Public query-log records are space-delimited, not JSON. If you route them to Firehose via a CloudWatch Logs subscription filter, Bronto stores each line raw and a [custom parser](/core-features/custom-parser) is required to extract fields. See [Formats requiring a custom parser](./aws-firehose#formats-requiring-a-custom-parser).
</Note>

## Alternatives

* [**S3 Log Forwarder**](./aws-client-s3) — for Resolver query logs delivered to an S3 bucket.

See [Ingesting AWS Data into Bronto](./aws-overview) for the full service-to-method mapping.

## References

* [Amazon Route 53 — logging DNS queries](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html)