Geo‑Spatial Heatmaps of DNS Queries with Databricks Mosaic

The vast scale and high granularity of DNS telemetry make it an ideal source for understanding how users and devices interact with the internet across both time and space. By analyzing the geographic distribution of DNS queries, organizations can gain insights into regional demand patterns, uncover the geographic reach of malware campaigns, evaluate CDN performance, detect anomalies in query behavior, and support compliance with data residency policies. However, the sheer volume and velocity of DNS logs—often amounting to billions of events per day—present significant challenges for traditional spatial analytics workflows. Databricks Mosaic, an advanced geospatial analytics library built on top of Apache Spark and integrated with the Databricks Lakehouse Platform, provides the scalability, performance, and tooling required to generate high-resolution geo-spatial heatmaps from DNS data with precision and efficiency.

A DNS query heatmap typically represents the density or intensity of DNS activity across a geographic grid. To create such a visualization, raw DNS logs must be enriched with geolocation metadata, aggregated spatially and temporally, and converted into a format suitable for mapping. The raw logs usually include fields such as timestamp, client IP address, query name, query type, and response code. The first step in enabling geo-spatial analysis is to translate IP addresses into geographic coordinates—most commonly latitude and longitude pairs—using IP-to-location databases such as MaxMind GeoLite2, IP2Location, or commercial services with higher accuracy for mobile and enterprise traffic. This enrichment can be implemented as a Spark UDF or integrated via Delta Live Tables to ensure that location metadata is attached in near real-time as DNS events are ingested into the data lake.

Once geolocation attributes are added, the next task is to partition the earth’s surface into a grid that supports spatial aggregation. This is where Databricks Mosaic introduces powerful abstractions. Mosaic extends Spark with support for space-filling curves, tiling systems, and geometric operations, including H3 indexing, which is particularly effective for DNS telemetry due to its hierarchical structure and compact representation. H3, developed by Uber, divides the earth into hexagonal cells at varying resolutions. By assigning each DNS query to an H3 cell based on its latitude and longitude, analysts can group queries into spatial buckets and perform efficient aggregations such as query count, unique clients, or entropy of domain names per region.

For time-aware heatmaps, queries are further grouped by temporal windows—commonly hourly or daily intervals—which enables the creation of animated visualizations showing how DNS activity evolves geographically over time. With Spark’s distributed computation model, these aggregations scale linearly with data volume, allowing entire months or years of DNS data to be processed across global client populations. Mosaic supports direct conversion of H3 indices into GeoJSON or WKT formats, making it straightforward to export results into downstream visualization tools such as Kepler.gl, Deck.gl, Plotly, or even GIS platforms like QGIS and ArcGIS.

In practice, a heatmap of DNS queries might reveal dense query volumes emanating from metropolitan centers during business hours, followed by a shift toward residential regions in the evening. Certain domains, such as content delivery platforms or cloud services, may exhibit global uniformity, while others—like government portals, local media, or regional malware infrastructure—display highly localized query patterns. By filtering DNS queries by query name or response code before aggregation, analysts can produce domain-specific heatmaps, such as the geospatial footprint of users accessing a particular SaaS application or the regional spread of queries returning NXDOMAIN for a takedown-listed domain.

Anomalous patterns also emerge clearly in this spatial view. A sudden spike in DNS queries from a region not previously associated with certain activity may indicate botnet propagation, new market expansion, or VPN usage. Likewise, repeated queries to encrypted DNS endpoints from a region without expected traffic could point to exfiltration attempts or misconfigured infrastructure. The ability to join spatial data with external datasets, such as autonomous system numbers (ASNs), hosting provider metadata, or threat intelligence feeds, enables Mosaic-powered pipelines to add attribution and context to each hotspot on the heatmap.

Performance optimization is key when working with large-scale DNS logs and high-resolution spatial grids. Databricks Mosaic benefits from Spark’s Catalyst optimizer and Delta Lake’s support for partition pruning, enabling rapid scanning of only the relevant data based on time or region filters. Additionally, caching strategies, broadcast joins for enrichment datasets, and the use of vectorized UDFs reduce the overhead of geolocation lookups and spatial transformations. When paired with photon-accelerated queries in Databricks, these optimizations allow heatmaps to be generated in minutes even from terabyte-scale raw DNS logs.

Security and compliance considerations are carefully addressed through access controls and data minimization. While the goal is to understand DNS query patterns at a population level, individual user privacy must be preserved. This is achieved by aggregating data at sufficiently coarse spatial resolutions, anonymizing or generalizing IP address fields before geolocation, and excluding personally identifiable domain queries. Audit logs and role-based access policies in Databricks ensure that only authorized personnel can run or view geospatial DNS analytics, and sensitive enrichment datasets are secured via credential passthrough and encrypted storage.

Beyond visualization, geo-spatial DNS heatmaps built with Mosaic serve as inputs for predictive models and automated monitoring systems. Machine learning models can detect deviations from baseline geospatial patterns, classify query clusters by threat level, or estimate service adoption rates across regions. These models are trained on feature sets that include spatial density, movement of hotspots over time, and overlap with known infrastructure. Once trained, the models can be deployed to flag new regions experiencing unexpected DNS behavior in real time, supporting proactive investigations and incident response.

In large, multinational environments—such as global CDNs, enterprise VPN providers, or internet backbone operators—geo-spatial DNS heatmaps are used to guide architectural decisions. By identifying where query latency is highest or where query volume is growing fastest, teams can strategically place new resolver nodes, cache endpoints, or edge data centers. This enables not just better performance, but also improved compliance with data localization laws, as queries can be resolved within their originating jurisdiction whenever possible.

In summary, the combination of DNS telemetry, geospatial intelligence, and the computational capabilities of Databricks Mosaic creates a powerful platform for visualizing and understanding global internet activity at an unprecedented scale and resolution. Whether used for cybersecurity, network planning, digital experience monitoring, or regulatory compliance, DNS query heatmaps are an indispensable tool—and with Mosaic, they are more accessible, accurate, and scalable than ever before. As the demand for location-aware analytics continues to grow, this integration will become increasingly vital for operational visibility and strategic insight in a globally distributed digital landscape.

The vast scale and high granularity of DNS telemetry make it an ideal source for understanding how users and devices interact with the internet across both time and space. By analyzing the geographic distribution of DNS queries, organizations can gain insights into regional demand patterns, uncover the geographic reach of malware campaigns, evaluate CDN performance,…