You can see an example of the DNS logs collected on page 803 of the Senate Intelligence report rather than reading blog. Clearly the Alfa bank did DNS lookups of the Trump domain and the explanation doesn't pass the smell test.

https://www.intelligence.senate.gov/sites/default/files/docu...

And the evidence of a cover-up by the Trump Corporate IT director (Cho) is on the following pages.

>According to Cho, at the time of the suspicious activity, the domain maill.trumpemail.com belonged to the Trump Organization's email marketing company, Cendyn Hospitality
Marketing.5142 Cho learned from Cendyn that the trump-email.com domain was originally
created for Trump Hotels email marketing sometime between 2009 and 20115143 and the domain
had been used as recently as November 2015 for Trump Hotel marketing emails.5144 At some
point prior to September 29, 2016, the domain registration was transferred from Cendyn to the
Trump Organization; internal emails suggested it may have occurred on September 23, 2016,
around the time the press began inquiring, although Cho could not identify any specific date with
certainty.5145 According to Cho, the Trump domain had been used to send mass marketing
emails, but not to receive email.5146

>Cho looked up the IP addresses belonging to the two Alfa Bank servers. Based on a
port scan of one server's IP address on October 1, 2016, Cho found that it was not configured as
an email or web server: "It only had port 53 open, which is a port for DNS lookup."5147 From this, he inferred that both of the Alfa Bank servers were configured as DNS servers, and
therefore could not have been used to transmit email communications to the Trump domain. 5148
Cho did not explain if he also conducted a port scan of the other Alfa Bank IP address, or how he
determined that the configuration on October 1, 2016 would have been the same as the server's
configuration during the time period in question.

>Cho did not recall conducting a system-wide review of the Trump Organization
network to determine if there wer~ any connections from the Trump Organization side with any
of the Alfa Bank servers.5149 Instead, he looked up the public IP addresses for two separate Alfa
Bank email servers he had identified, which he then provided to Cendyn to check if Cendyn
could identify communications involving those servers.5150 In response, Cendyn found six
messages to Alfa Bank recipients from clients using one of its email applications, but stated that
these communications were not connected to the Trump Organization.5151 Cendyn identified
these as emails sent by existing banking or hotel customers of Cendyn through a meeting
management application to an Alfa Bank email address.5152 Cho did not locate any substantive
communications between the Trump Organization and the two Alfa Bank servers and did not
pursue further investigation of the DNS activity.5

>Cendyn did not explain how the unusualDNS lookup activity might relate to those
emails and did not filter its records to find information like the DNS logs at issue.515~
Nonetheless, based on Cendyn's findings, Cho concluded that the rough "correlation" between
these email~ and the DNS logs might explain how the press had "put these together as some kind
of activity between Alfa Bank and Cendyn, which happened to have one of their host names with
our Trump name in it, 'Trump-email.com."'5155 The Committee did not engage C,endyn on this
matter.

> Unprompted, the Committee also received two letters, dated March 16 and July 20,
2018, from an attorney representing Alfa Bank conveying the findings of internal investigations
into the unusual DNS activity. The letters represented that Alfa Bank had retained Mandiant, acyber incident response firm, to conduct an internal investigation based on the DNS logs and had
found no evidence of substantive communications between Alfa Bank and the Trump
Organization.5156 However, one letter noted that Alfa Bank had "continue[d] to receive
unsolicited marketing emails from an address allegedly affiliated with the Trump Organization,"
which it did not identify.5157 As to the cause of the DNS activity, that letter posited Mandiant's
"working hypothesis is that the activity was caused by a marketing or spam campaign directed at
Alfa Bank employees by a marketing server affiliated with the Trump Organization."5158

And then several paragraphs of blacked out text.