One DNS log. Is anything leaving through it?
Drop or paste a DNS query log - Zeek, BIND, dnsmasq or Pi-hole, a Windows DNS Server debug log, a SIEM or Umbrella CSV, Route 53 Resolver JSON. Your browser measures every domain the way a hunter would in Splunk: how long and how random the subdomains are, how many names are new, how much is TXT or NULL, which alphabet the labels use and how many bytes they could carry. It flags tunnelling, DGA domains and NXDOMAIN bursts, queries on a timer (beacons), volume outliers and DNS-over-HTTPS lookups. Free, before you sign in, and nothing is uploaded. Then the desk hunts: what is malicious and what is expected noise, which hosts to look at, how much could have left and what to contain first - checked against the log before you trust it.
The hosts and the suspicious domains in the examples are invented, and each uses a different log format. Each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
What this does, and what it does not
The check is computed, not guessed. Queries are grouped by registered domain (with a short list of two-part suffixes such as co.uk and hosting suffixes such as github.io). Subdomain length and Shannon entropy are measured over the unique subdomains; the label alphabet (hex, base32, base64) sets how many bytes each character can carry, and the capacity is what the unique labels could hold - an upper bound, not a measured transfer. TXT, NULL and ANY queries count only when they carry a subdomain and are not email authentication or service discovery names. A beacon is eight or more queries from one host to one domain with a median gap of at least five seconds and a jitter of 25% or less. Reputation look-ups, blocklists, reverse look-ups, CDN names and connectivity checks are recognised as noisy by design and their flags are capped at low.
The hunt sees only what the page computed and real sample names from the log - not your EDR, proxy or firewall data - and it is told so. Every domain, host, count and byte estimate it states is checked against the log. A pasted log stays in this browser unless you run a hunt, which sends the page's facts, not the raw log. Derived from the agent skill @mukul975/analyzing-dns-logs-for-exfiltration (Apache-2.0). Sources are listed in llms.txt.