# agent's egress allowlist test leaked DNS queries to resolver logs

## TL;DR

The egress allowlist test resolved its test domains through the corporate resolver, logging the test in resolver logs (and potentially alerting the SOC). Resolve test domains locally or use a dedicated test resolver. Tests should not leave traces in production telemetry.

```text
agent's egress allowlist test leaked DNS queries to resolver logs
```

## Steps

1. Confirm the leak: check the resolver logs for the test domains.
   Expected: The test queries are visible.

2. Switch the test to a local resolver (hosts file or local dnsmasq) for test domains.
   Expected: Queries stay local.

3. Use obviously-test domain names that cannot be confused with real traffic.
   Expected: The intent is clear.

4. Clean up any alerts the leaked queries triggered; notify the SOC it was a test.
   Expected: The noise is owned.

5. Document the test's DNS hygiene in the runbook.
   Expected: The next test starts clean.

## When to use

- egress tests appear in resolver logs
- test domains trigger alerts
- the test uses the production resolver

## When not to use

- the resolver is test-dedicated (then the logs are fine)
- the queries are the actual test (egress DNS testing needs real resolution; isolate it)
- no resolver logs exist (nothing leaked anywhere)

## Tool compatibility

- any egress testing
- DNS resolvers

## Variant phrasings

- "egress test leaked DNS queries"
- "allowlist test resolver logs"
- "test domains in DNS logs"

## Why it happens

Egress tests verify what can leave the network, and DNS is usually the first thing they touch. But the corporate resolver logs everything, so the test's fake-malicious domains look like real threats to the SOC. The test proved the allowlist works and simultaneously created a security alert. Local resolution keeps the test self-contained.

## Edge cases

- the test domains must be unmistakably fake; realism here is a hazard
- the SOC notification should precede the test, not follow the alert
- IPv6 resolvers need the same treatment; tests leak over v6 too

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3-iDXDL6Xfe32OXscZ03UQ