note about CNAME chains

Author: greg-lindsay

articles/dns/dns-security-policy.md

@@ -5,7 +5,7 @@ author: greg-lindsay
 manager: KumuD
 ms.service: azure-dns
 ms.topic: article
-ms.date: 02/10/2025
+ms.date: 02/24/2025
 ms.author: greglin
 ---
 
@@ -80,7 +80,12 @@ The following example shows a DNS security policy linked to two VNets (**myeastv
 
 DNS domain lists are lists of DNS domains that you associate to traffic rules. 
 
-Select **DNS Domain Lists** under **Settings** for a DNS security policy to view the current domain lists associated with the policy. The following example shows the DNS domain lists that are associated with the DNS security policy **myeast-secpol**:
+Select **DNS Domain Lists** under **Settings** for a DNS security policy to view the current domain lists associated with the policy. 
+
+> [!NOTE]
+> CNAME chains are examined ("chased") to determine if the traffic rules that are associated with a domain should apply. For example, a rule that applies to **malicious.contoso.com** also applies to **adatum.com** if **adatum.com** maps to **malicious.contoso.com** or if **malicious.contoso.com** appears anywhere in a CNAME chain for **adatum.com**.
+
+The following example shows the DNS domain lists that are associated with the DNS security policy **myeast-secpol**:
 
 [  ![Screenshot of the list of DNS domain lists.](./media/dns-security-policy/domain-list.png) ](./media/dns-security-policy/domain-list.png#lightbox)
 

articles/dns/dns-traffic-log-how-to.md

@@ -4,7 +4,7 @@ description: Learn how to filter and view Azure DNS traffic
 author: greg-lindsay
 ms.service: azure-dns
 ms.topic: how-to
-ms.date: 01/29/2025
+ms.date: 02/24/2025
 ms.author: greglin
 ---
 
@@ -116,6 +116,9 @@ Multiple domain lists can be dynamically added or removed from a single DNS traf
 
 Now that you have a DNS domain list, configure the diagnostic settings in your security policy to use this workspace.
 
+> [!NOTE]
+> CNAME chains are examined ("chased") to determine if the traffic rules that are associated with a domain should apply. For example, a rule that applies to **malicious.contoso.com** also applies to **adatum.com** if **adatum.com** maps to **malicious.contoso.com** or if **malicious.contoso.com** appears anywhere in a CNAME chain for **adatum.com**.
+
 To configure diagnostic settings:
 
 1. Select the DNS security policy that you created (**myeast-secpol** in this example).