What DNS is
DNS is the phonebook of the internet. Every time a device on your network wants to reach a website, an app, or a server, it first asks DNS to turn a name into an address. example.com becomes 93.184.216.34. Nothing connects without that lookup happening first.
Why every device uses it
Every device on your network — phone, laptop, smart TV, thermostat — uses DNS. The names are for humans; the numbers are for machines. DNS is the bridge. Because it is universal, it is also a complete record of every connection your devices try to make.
What it reveals
A DNS log tells you which domains were looked up, from which device, and when. That is enough to see what your network is doing without inspecting the content of any connection. You see the question, not the answer. For awareness, that is enough.
What it does not reveal
DNS does not show the content of a connection. It does not show what was sent, what was received, or how much data moved. It shows that a connection was initiated, and to where. That makes it lightweight and private by construction — there is no payload to leak.
This is the design choice behind Heron: observe the questions, not the answers.
Recursive versus authoritative
When a device asks for example.com, it does not ask the server that runs example.com directly. It asks a recursive resolver — usually the one your router points at, or one provided by your ISP or a public resolver like 1.1.1.1. The resolver chases the answer across the authoritative servers and hands back the address. Heron sits between your devices and that resolver, watching every request pass through.
Why it is observable
DNS runs on port 53, unencrypted by default, and every device on the network needs it. That makes it a single, visible chokepoint. You do not need to inspect traffic on every device. You point DNS at one place and watch it there. That is what Heron does.