Look for the section that deals with logging categories, and specifically at category queries:
The query log entry reports the client’s IP address and port number, and the query name, class and type. Next it reports whether the Recursion Desired flag was set
(+ if set, - if not set), if the query was signed (S), EDNS was in use (E), if TCP was used (T), if DO (DNSSEC Ok) was set (D), or if CD (Checking Disabled) was set (C).
+EDC on a query indicates that it is:
- Recursive (+) - it has come from a client or a server that is forwarding queries to your server
- The sender is using EDNS0 (using larger UDP packet sizes and signalling the size that can be accepted)
- The sender understands DNSSEC (D) - this is a request to your server to include any DNSSEC material associated with answer in the query reply.
- DNSSEC validation checking is disabled (C) - the sender wants the answer anyway, even if the validation checks fail.
