dnstap implements an encoding format for DNS server events. It uses a lightweight framing on top of event payloads encoded using Protocol Buffers and is transport neutral.

dnstap can represent internal state inside a DNS server that is difficult to obtain using techniques based on traditional packet capture or unstructured textual format logging.


dnstap-gael.dnstap --help

Example using Knot Resolver (

snap connect dnstap-gael:home :home

snap connect knot-resolver-gael:home :home

sudo dnstap-gael.dnstap -q -u /root/dnstap.sock

sudo vi /var/snap/knot-resolver-gael/current/kresd.conf

modules = { dnstap = { socket_path = "/root/dnstap.sock", identity =, version = package_version(), client = { log_queries = true, log_responses = true, }, } }

sudo snap restart knot-resolver-gael.kresd


  • v0.4.0 available on amd64, arm64 & armhf

Get it from the Snap Store

Search for another snap, or go back to the homepage.