You can monitor and report on Edge DNS service availability, traffic, and threats by creating reports in Control Center.

Alternatively, you can monitor traffic programmatically using the Akamai Reporting API. With this API, you can retrieve DNS hit information to monitor traffic in real time.

Edge DNS reports

Edge DNS reports provide real-time and historical reporting about the authoritative DNS service. Each report lets you display data on a dashboard according to selected filters.

The following reports monitor traffic on the service. Use these reports to analyze usage patterns, troubleshoot threats, forecast capacity, and compile information for others. Used together, these reports provide a rich picture of your Edge DNS traffic.

Edge DNS
Edge DNS Today
Edge DNS Zone Detail

Additionally, there are traffic reports that provide details about potential threats. A potential threat is defined as a large relative increase in NXDOMAIN responses, either as a sharp spike or as a sustained increase.

Edge DNS Threats Summary
Edge DNS Threat Details
Security Analytics - Security Summary
Security Analytics - Edge DNS Summary
Security Analytics - Edge DNS Zone Details
Security Analytics - NXDOMAIN Spike Details

📘
To view the Security Analytics reports with complete data, make sure you configure NXDOMAIN spike thresholds and enable dangling CNAME detection. For more information, see Set up security analytics.

The next table summarizes the Edge DNS reports available on Control Center, and provides links to detailed information about each report.

Report	Description
Edge DNS Availability	Tracks availability (uptime) of the service for the selected contract and time frame up to 90 days. The report includes a graphic visualization displaying availability percentages over the selected time frame. Additionally, the report includes metrics for the average, maximum, and minimum availability.
Edge DNS	Includes traffic data on the service for the selected zones and time frame up to 90 days. The report provides graphic visualizations for DNS requests per second and NXDOMAIN responses per second, along with summary metrics for total DNS hits, peak DNS hits per second, total NXDOMAIN hits, and peak NXDOMAIN hits per second. Additionally, the report provides per-zone summary metrics for the number of DNS requests, number of NXDOMAIN responses, and percentage of NXDOMAIN responses.
Edge DNS Today	Includes more detailed traffic data than the Edge DNS report, for the selected zones and time frame up to 14 days. The report provides a heat map of query source locations by geographic region, along with graphic visualizations and metrics of DNS requests and nonexistent domain (NXDOMAIN) responses.
Edge DNS Zone Detail	Includes even more traffic data than the Edge DNS Today report, for one selected zone during the selected time frame up to 14 days. The report provides a heat map of query source locations by geographic region, along with graphic visualizations and analytics of DNS requests. Additionally, the report provides hits per second over time, record-level counts, and top NXDOMAINs for the selected time frame. Record-level counts are helpful to learn about use at the label level. Top NXDOMAINs help characterize and understand a common attack vector known as random subdomain, where an attacker gains control over a subdomain of a target domain.
Edge DNS Threats Summary	Includes summary data about potential threats associated with the selected zones and time frame up to 90 days. The report includes graphic visualizations of DNS requests per second and NXDOMAIN responses per second over time, a table summarizing the graph metrics, and a table listing per-zone metrics of potential threats. Additionally, the report includes a link to each zone's Edge DNS - Threat Details report for further threat analysis.
Edge DNS Threat Details	Provides more data than the Edge DNS - Threats Summary report about potential threats associated with one selected zone for the selected time frame up to 90 days. For the selected zone threat, the report provides threat summary metrics and graphic visualizations of DNS requests per second and NXDOMAIN responses per second, heat maps with DNS request counts and NXDOMAIN response counts by geographic region, and record-level counts of the most-requested existing DNS records and most-requested nonexistent DNS records.
Security Analytics - Security Summary	Provides data on DNS traffic, NXDOMAIN responses, and based on configured thresholds, the NXDOMAIN spikes in your selected zone or zones. This report also correlates data to show information on DNS traffic across these delivery and security products: Prolexic, App & API Protector, and Web Security.
Security Analytics - Edge DNS Summary	Provides details on DNS requests and NXDOMAIN responses. This report shows the total number of DNS responses, NXDOMAIN spikes, and the percentage of traffic that contains NXDOMAIN responses. It also shows the countries where most requests and NXDOMAIN responses occurred.
Security Analytics - Edge DNS Zone Details	Provides data on DNS traffic, NXDOMAIN responses, and NXDOMAIN spikes in a selected zone or in multiple zones. This report shows the countries where most DNS requests and NXDOMAIN responses occurred.
Security Analytics - NXDOMAIN Spike Details	Provides additional information on NXDOMAIN spikes. This data includes overall DNS traffic, NXDOMAIN responses, NXDOMAIN spikes, the countries where most DNS request and NXDOMAIN responses occurred, and the peak rate of DNS traffic and NXDOMAIN responses. The report also identifies the most requested domain and the most requested NXDOMAIN record.

Configure Edge DNS reports

The time ranges and details returned by a report varies based on the filter values you choose. By default, the first time you access a report in your account, the report displays data for the current day. When you change the date range, the system remembers your configuration and ties it to your account ID. The next time you access the report with your account, the report displays data for the last configured date range.

Complete the following instructions to configure an Edge DNS report. For additional information, see also How to use reports.

Log in to Control Center.
Go to ☰ > COMMON SERVICES > Traffic reports.

📘
Reports are available based on the services you use and your permissions in Control Center.
In the left sidebar, hover over the Edge DNS icon and from the context menu, select a report from these options:
- Edge DNS
- Edge DNS - Availability
- Edge DNS - Today
- Edge DNS - Zone Detail
- Edge DNS - Threats Summary
- Edge DNS - Threat Details
- Security Analytics - Edge DNS Summary
- Security Analytics - Edge DNS Zone Details
- Security Analytics - NXDOMAIN Spike Details
- Security Analytics - Security Summary
The report panel on the left side of the page appears dimmed, and the Select filters panel on the right is active.
Select filter values to refine the report data. For guidance, see Date ranges and Filters. When you are done, click Apply.

The Select filters panel closes. The report dashboard displays on the page.

Schedule report delivery

After you've configured a report, you can schedule it for email delivery. Select filters and view the report in the browser before scheduling it for delivery. For additional information, see Scheduled reports.

In the browser, open the report you want to schedule for delivery.
Click the graph icon on the top toolbar and select Schedule/Send now.

You see non-editable details for the chosen report.
In the Report Name field, enter the report name.

The name defaults to the metric for the report, which you can edit it.
Enter one or more email addresses for the report recipients. Separate email addresses with a comma; do not insert any spaces.
Select one of the available delivery frequencies:
- Once
- Daily
- Weekly
- Monthly
If you selected a Daily, Weekly, or Monthly frequency, select a date range.
Select one of the following formats.
- HTML
- CSV
From the Visualizations menu, select charts that you want included.
Click Apply.

Set up security analytics

You can analyze Edge DNS zones for nonexistent domain (NXDOMAIN) spikes and dangling canonical name (CNAME) records. A NXDOMAIN spike indicates an increase in responses from nonexistent domains, while dangling CNAME detection checks whether a CNAME record points to a resource that does not exist. By identifying and detecting these threats, your organization can take the necessary steps to prevent denial-of-service attacks and stop threat actors from taking over subdomains.

To report on these threats, enable NXDOMAIN and dangling CNAME detection. For NXDOMAIN detection, you need to configure the spike thresholds.

After you enable the features, the Security Analytics page shows the number of NXDOMAIN spikes and dangling CNAME records that were detected in each of your zones. You can expand zone information to view when the zone was last scanned for NXDOMAIN spikes and dangling CNAME records.

The Security Analytics lets you download CSVs with specific information for a zone. You can:

View and download a CSV that contains dangling CNAME records that were detected.
View and download a CSV that contains NXDOMAIN spikes from the last 24 hours.
Generate and download a CSV that contains DNS records and the number of requests made to those domains.

From the Security Analytics page, you can can open these reports to view more data about DNS traffic and NXDOMAINs in your zones:

Security Summary
Edge DNS Summary
Edge DNS Zone Details
NXDOMAIN Spike Details

For more information on these reports, see Edge DNS reports.

Configure NXDOMAIN spike thresholds

To report data on NXDOMAIN spikes, configure the dynamic and absolute threshold that must be breached before an NXDOMAIN spike is tracked.

A dynamic threshold is the z-score or standard score for the number of NXDOMAINs that must be detected before traffic is considered part of an NXDOMAIN spike.
The absolute threshold is the number of responses per second from NXDOMAINs before traffic is considered part of an NXDOMAIN spike.

You can configure the dynamic and absolute thresholds for multiple zones or you can configure dynamic and absolute thresholds to a specific zone.

Configure the default NXDOMAIN spike thresholds for multiple zones

The default NXDOMAIN spike thresholds apply to zones where a spike threshold is not configured. The default setting applies to a maximum of 20 zones.

If NXDOMAIN spike thresholds are already set for a specific zone, those thresholds take precedence over the default settings. For more information, see Configure NXDOMAIN spike thresholds to a specific zone.

To configure NXDOMAIN spike threshold to a zone:

In Control Center, go to ☰ > DNS SOLUTIONS > Edge DNS. The Zone list page opens.
Click Security analytics.
At the top of the page, click Settings.
In the window that appears, enter the default dynamic threshold and the default absolute threshold in the provided text boxes.
Click Confirm.

Configure NXDOMAIN spike thresholds to a specific zone

Complete this procedure to configure NXDOMAIN spike thresholds to a specific zone.

If you’ve configured default NXDOMAIN spike thresholds, the threshold settings you set to a zone with this procedure take precedence over the default settings.

To configure NXDOMAIN spike thresholds to a zone:

In Control Center, go to ☰ > DNS SOLUTIONS > Edge DNS. The Zone list page opens.
Click Security analytics.
Go to the zone where you want to configure NXDOMAIN spike thresholds. If necessary, search for the zone.
From the Actions menu, select Settings.
In the window that appears, click NXDOMAIN Spikes.
Enable NXDOMAIN Spike Detection.
In the Threshold Type menu, select whether you want to apply a dynamic or absolute threshold.
In the Dynamic Threshold field, enter a z-score or standard score value that must be met for traffic to be considered part of an NXDOMAIN spike.
In the Absolute Threshold field, enter a value for NXDOMAIN responses per second.
Click Confirm.

Download CSV with NXDOMAIN spikes

Complete this procedure to download a list of NXDOMAIN spikes that occurred for a zone within the last 24 hours.

To download a CSV with NXDOMAIN spikes:

In Control Center, go to ☰ > DNS SOLUTIONS > Edge DNS. The Zone list page opens.
Click Security analytics.
Go to the zone that has NXDOMAIN spikes you want to review.
From the Actions menu of that zone, select NXDOMAIN Spikes. A window appears with a list of NXDOMAIN spikes.
Click the download icon to download this list in a CSV file.

Next Steps:

Expand an NXDOMAIN spike to view the threshold type and the average number of NXDOMAINs per second. Click Investigate to open the NXDOMAIN Spike Details report.

Enable dangling CNAME detection

Complete this procedure to enable dangling CNAME detection.

To enable dangling CNAME detection:

In Control Center, go to ☰ > DNS SOLUTIONS > Edge DNS.
Click Security analytics at the top of the page.
Go to the zone where you want to enable dangling CNAME detection.
In the Actions menu, select Settings.
If you would like administrators to receive email alerts about dangling CNAME records, in the General tab, enter email addresses in the Alerting Emails field.
In the zone settings window, go to the Dangling CNAMEs tab.
Enable Dangling CNAME Detection.
To enable alerting for dangling CNAME records, enable Dangling CNAME Alerting.
Click Confirm.

View and download list of dangling CNAME records

You can view and download a list of dangling CNAME records that were detected for a zone.

To view and download a list of dangling CNAMES:

In Control Center, go to ☰ > DNS SOLUTIONS > Edge DNS.
Click Security analytics. A list of zones appears in a table. The table shows the NXDOMAIN spikes and the dangling CNAME records that were detected.
Click the Action menu for a zone where a dangling CNAME was detected.
Select Dangling CNAMEs. A window appears with dangling CNAME records. Click the download icon to download a CSV that contains CNAME record names and their corresponding aliases.

Generate and download a zone report

You can generate and download a report that shows the DNS records for a zone and the total number of requests that were made to a record.

For each zone, the last three reports you generate are saved in Control Center.

To generate and download a zone report:

In Control Center, go to ☰ > DNS SOLUTIONS > Edge DNS.
Click Security analytics. A list of zones appears in a table.
Click the Action menu for a zone and select Zone Reports.
In the zone report window, click the calendar icon and select a range of time. You can select any time period that spans 31 days or less.
Click Generate. Control Center generates the CSV report. Depending on the amount of data, the time it takes to generate the report may vary.
When completed, click the download icon to download the report.
Click Close.