Definition
A query or response pattern that differs from expected behavior, such as sudden NXDOMAIN growth, unusual labels, rare record types, high entropy, or traffic from an unexpected client. An anomaly is a signal, not proof of malicious activity.