# DNS Query Logging — Router Onboarding

Added to the onboarding script after SSH key setup but before heartbeat:

```
/ip/dns/set allow-remote-requests=yes log-queries=yes log-fwd-queries=yes
/system/logging/add action=remote topics=dns remote=10.77.0.1:514 remote-log-prefix="rtr-<customer-id>"
```

## What it captures

| Field | Source |
|---|---|
| Domain | Every DNS query from client devices |
| Client IP | Which internal IP made the query |
| Time | When the query was made |
| Record type | A, AAAA, MX, TXT, etc. |
| Response | Resolved IP or NXDOMAIN |

## Portal display

The router detail page DNS tab shows:
- Total queries, unique domains, active clients, blocked count
- Top domains by query count (last 7 days)
- Top client IPs by query volume
- Individual query log with time, client, domain, type, response

## Limitations

- **HTTPS content is NOT visible** — only domain names from DNS lookups
- Search queries (google.com/q=..., etc.) are NOT visible — they're inside HTTPS
- Only shows queries that go through the router's DNS resolver; devices using external DNS (8.8.8.8) are not logged