> the only data is domain name, record and the incoming ip Other data that can be logged: - timestamp - this can be very revealing when correlated with other

> the only data is domain name, record and the incoming ip Other data that can be logged: - timestamp - this can be very revealing when correlated with other datasets.j - ASN - can sometimes act like fingerprint on it's own, and assists in correlating other data (e.g. the timestamp) - any identifiable variation in the structure or behavior between different DNS resolver implementations. See nmap's "-O" option that detects the OS from the TCP/IP protocol implementation.