When performing threat hunting against a DNS server, which traffic toward the affected domain is considered a starting point?

HTTPS traffic operates over TCP port 443 and is unrelated to the DNS protocol stack used by a DNS server.

While DNS does use TCP for zone transfers and large responses, UDP is the primary and default transport for standard DNS queries, so TCP broadly is not the correct starting point.

HTTP traffic operates over TCP port 80 and has no role in standard DNS server communication or DNS-focused threat hunting.

DNS uses UDP port 53 as its default transport protocol for name resolution queries and responses. When threat hunting against a DNS server, analysts begin by filtering for UDP traffic because the vast majority of DNS communication occurs over UDP. Anomalies in UDP/53 traffic - such as unusually large payloads, high query volumes, or encoded subdomains - are key indicators of DNS-based attacks like tunneling or data exfiltration.