# What DNS Traffic Reveals ## Almost everything a device does starts with a name lookup DNS runs before the connection and before the payload. That makes it the earliest place a problem becomes visible, and it covers every device on the network without installing anything on them. Five things the traffic shows: | Signal | What it looks like | | --- | --- | | **Malware calling home** | a device reaching a command-and-control domain, before the payload runs | | **Shadow IT** | every SaaS domain a device resolves, mapped without an agent | | **Exfiltration and jurisdiction** | lookups landing outside the country the data is supposed to stay in | | **Algorithm-made domains** | a fresh generated domain each day; the pattern appears in DNS first | | **Earliest warning** | all of the above arrive before the connection is made | > [!tip] Why no agent is needed > Endpoint tools only see devices you can install software on. DNS sees ==everything that asks a question==, including printers, cameras, contractors' laptops and anything else on the network. Coverage comes free with the protocol. ## Why it matters This is the demand-side argument for the whole company. If DNS were only plumbing, a routing layer for it would be a cost-saving utility. Because DNS carries security, fraud and compliance signal, the same layer can be sold to four different budgets. The counterweight is volume. The signal is real and rare, and the base rate of ordinary lookups is enormous, which is why enrichment and filtering matter more than collection. ## Related - [[Red Onion MOC]] - [[DNS as a Security Signal]] - [[DNS Resolution Mechanics]] - [[Sovereign Intelligence and the Copy That Stays]] - [[Cyber Kill Chain]]