# DNSTAP and Where the Data Comes From ## An open streaming format that takes events straight from the resolver process DNSTAP is the mechanism behind the mirror. It is an open, structured format for streaming DNS events directly out of the resolver process, rather than writing text logs and parsing them afterwards. BIND, PowerDNS, Knot and Unbound all support it. Two properties matter: - **Line rate, low overhead.** Events leave as they happen, so there is no batch job and no measurable load on the resolver. - **Structured at source.** Query, client, timestamp and response arrive as fields, not as text to be reconstructed later. > [!important] Why this beats a network tap > A passive tap on the wire reads packets. Encrypted DNS, DoH in particular, makes those packets unreadable to anything that is not the endpoint of the connection. DNSTAP collects ==at the resolver, which is the endpoint==, so it keeps working as encryption spreads. > → [[Encrypted DNS Favours Resolver-Side Collection]] TelemetriX describes itself as the routing and enrichment layer that sits on top of DNSTAP-emitting infrastructure. Resolvers below, SIEM and data lake above, TelemetriX in between. ## Why it matters It grounds the product in something open and already deployed. The company does not have to persuade anyone to adopt a new agent or protocol, only to point an existing stream at a new destination. The corresponding limit is that a customer whose resolvers do not emit DNSTAP needs a different collection route, which is a question for any given deployment. ## Related - [[Red Onion MOC]] - [[Mirroring Instead of Touching the Resolver]] - [[Encrypted DNS Favours Resolver-Side Collection]] - [[DNS Resolution Mechanics]] - [[PowerDNS]] - [[CoreDNS]]