I'm using Bind 9.3 and have allow-recursion set to my local network. I need to log / find denied queries for domain I'm authoritative for but do not have zone files. I'd prefer to log only failed request but I'm unable to find a way. I've turned on query logging but I don't can't see how to find the failed denied queries. It there a way?