DNS-collector is a lightweight tool that captures DNS queries and responses from your DNS servers, processes them intelligently, and sends clean data to your monitoring, analytics and security systems.

What it does:

• Captures at scale: Ingests streams from BIND, PowerDNS, Unbound, etc., via high-speed DNStap protocol or live wire packet capture.
• Filters & normalizes: Discards noise (health checks, internal probes, spam) at wire speed before reaching storage.
• Enriches on-the-fly: Decorates records with GeoIP, ASN, threat intelligence, metadata, and custom tags.
• Streams everywhere: Dispatches batched events to ClickHouse, Kafka, Loki, Elasticsearch, Syslog, Prometheus, and more.

The missing high-performance data collector between DNS servers and your SIEM/observability/analytics stack.

• From Homelabs to Enterprises: High-performance DNS telemetry pipeline with a lightweight footprint for any scale of DNS infrastructure (BIND, PowerDNS, Unbound, etc.)
• DNS-Native & Edge Processing: Understands EDNS, query types, latency tracking, and anonymizes user IPs before storage.
• Flexible outputs: Files, syslog, databases, monitoring tools and more...
• Production ready: Used in real networks, tested with major DNS servers
• Enhanced DNStap: TLS encryption, compression, and more metadata capabilities

Download the latest release and create a simple config.yml pipeline:

pipelines:
  - name: tap
    dnstap:
      listen-ip: 0.0.0.0
      listen-port: 6000
    transforms:
      normalize:
        qname-lowercase: true
    routing-policy:
      forward: [ console ]
  - name: console
    stdout:
      mode: text

Default setup listens on tcp/6000 for DNStap streams and outputs to stdout.

Run the collector:

./dnscollector -config config.yml

Contributions are welcome! Check out:

• Contribution Guide
• Architecture Guide
• Development Guide

• DNS-tester - DNS testing toolkit
• CoreDNS-GSLB - Global Server Load Balancing functionality in CoreDNS