How To Generate GCP DNS Logs

After getting your DNS server policy configured, follow these steps to ensure that DNS logging is enabled:

1. Click on ‘DNS server policy’ in Cloud DNS.
2. Click on the name of the policy that you want to get logs from, then click ‘Edit Policy’.
3. Under Logs, select the ‘on’ option and then click on save. (If the ‘on’ option is already selected, it means that your logging is already enabled.)

This will allow logs from the internal VPC DNS queries to be generated in Cloud Logging.

Alternatively, you can run the following command in the cloud shell to enable logging for a particular DNS server policy -

gcloud dns policies update [policy name]    --networks=[VPC network’s name] --enable-logging

Alternative to what John suggested, in order to see the logs generated by the DNS queries, you can follow these steps:

1. Search ‘Logs explorer’ in the search bar in the console, click on ‘Logs Explorer’.
2. Under resource, select ‘Cloud DNS Query’, then select your preferred DNS Zone name, then select your preferred location from where queries are received, click add.

Or you can run the following query in Logs Explorer to see the required logs:

resource.type="dns_query" 
resource.labels.target_name="[preferred Zone’s name]" 
resource.labels.location="[preferred location to receive queries]"

Now you would be able to see the logs generated for the DNS queries made.

I don't know about GCP logs but you can diagnose where/how DNS requests are handled/directed:

dig -t A a.root-servers.net.

This command asks for an IPv4 address (record -type A) for the host a.root-servers.net (a well known DNS server IIRC - see https://www.iana.org/domains/root/servers)

result:

...
;; ANSWER SECTION:
a.root-servers.net. 421290  IN  A   198.41.0.4
...

dig -t AAAA a.root-servers.net.

This requests an IPv6 address (record -type AAAA)

result:

...
;; ANSWER SECTION:
a.root-servers.net. 464385  IN  AAAA    2001:503:ba3e::2:30
...

knowing a.root-servers.net. is a DNS server, we can lookup the records stored for another server (starting from one of the root DNS servers)...

dig @198.41.0.4 -t AAAA a.root-servers.net.

Here we are asking DNS host 198.41.0.4 for the address of alias a.root-servers.net. We get an IPv6 response and some additional details

If we have a host name we want to lookup we can check the route to it via DNS servers in the following way:

ping google.com
PING google.com (142.250.178.14): 56 data bytes
64 bytes from 142.250.178.14: icmp_seq=0 ttl=117 time=20.805 ms

lookup DNS server for where the IP address is resolved

host 142.250.178.14
14.178.250.142.in-addr.arpa domain name pointer lhr48s27-in-f14.1e100.net.

We can go to any publicly listed DNS server - e.g. google's 8.8.8.8 (IIRC 8.8.4.4 is also a DNS server run by google) - and we can lookup ANY record to navigate through the DNS servers to find out which DNS server stores our record for the DNS entry we're interested in to see how it gets resolved.

dig @8.8.8.8 -t ANY 14.178.250.142.in-addr.arpa

This returns the list of name servers responsible for domains beginning 14.178.250.*

Result:

...
;; ANSWER SECTION:
14.178.250.142.in-addr.arpa. 21599 IN   PTR lhr48s27-in-f14.1e100.net.
...

PTR here just means pointer.

doing the same lookup again: dig @8.8.8.8 -t ANY lhr48s27-in-f14.1e100.net.

We get the result of an A record (IPv4 entry).

...
;; ANSWER SECTION:
lhr48s27-in-f14.1e100.net. 21599 IN A   142.250.178.14
...

This is the IP address for (probably a load balancer for) Google.com.

You can navigate down the initial DNS server, via other DNS servers (there are many) until you get to an A / AAAA Record.