Secure DNS update authentication log

[Wes-Ev]

Hi,

I have a problem where secure DNS updates fail while on VPN. I can see that the machine account is getting a Kerberos ticket for DNS for a specific DNS server. I want to confirm the DNS update is actually going to the DNS server that the ticket is for. Normally this wouldn't be so hard but with VPN and the VPN server proxying DNS request is not quite clear what server the DNS update was directed to.   

So lets suppose my Kerberos ticket included in the secure DNS update is not correct, so it fails like an Access Denied, what log would that be written in? 

Thanks,

-Wes

[#2]

Something here may help.

DNS Logging and Diagnostics | Microsoft Docs

[#3]

Looks perfect. Thanks. I should have found that myself.

[#4]

Sounds good, you're welcome. 

(please don't forget to mark helpful replies)