Telemetry
Telemetry is the steady background hum of devices reporting home. Usage stats, crash logs, feature flags, "anonymous" metrics. It is rarely malicious on its own, but it is unilateral — the device decides to send it, and you are not asked. The first sign of a chatty device is usually a DNS log full of domains you never typed.
Phone-home behavior
Some devices check in with a server on a schedule — every few minutes, every hour. Sometimes it is update checking. Sometimes it is reporting state. Sometimes it is keeping a connection warm so the vendor can push a command. The pattern in the log is regular, repetitive lookups to the same handful of domains. That regularity is the signature.
Fingerprinting
Fingerprinting is identification without cookies. A service reads your device's characteristics — screen size, fonts, timing, headers — and builds a unique enough profile to track you across sessions and sites. DNS does not show fingerprinting directly, but it shows the third-party domains a device reaches that perform it.
New connections
The most useful signal in a DNS log is a connection you have never seen before. A device that has been quiet for weeks suddenly resolving a domain you do not recognize. It might be an update. It might be nothing. It might be the thing worth looking at. Heron flags new-connection events for exactly this reason.
You are not looking for one bad domain. You are looking for a change in the pattern.
What DNS cannot tell you
DNS shows the destination, not the intent. A lookup to a telemetry domain might be a single ping or a large upload. A lookup to an ad network might be a banner or a full tracker. The log tells you that the connection happened, and the regularity tells you the kind. What you do with that is up to you — that is the awareness model.