Stream over 300,000 DNS events per second directly from your servers - no packet capture, no debug logging, no disk I/O.
{
"timestamp": "2000-01-01T19:00:00Z",
"host": "windows2025",
"schema": 1,
"type": "client-response",
"data": {
"client": "192.168.68.164",
"server": "192.168.68.162",
"port": 61776,
"proto": "udp",
"size": 89,
"txid": 1085,
"flags": {...},
"qname": "www.telemity.com.",
"qdomain": "telemity.com.",
"qclass": "IN",
"qtype": "A",
"rcode": "NOERROR",
"answers": [
{
"name": "www.telemity.com.",
"domain": "telemity.com.",
"ttl": 600,
"rrclass": "IN",
"rrtype": "A",
"data": "20.47.114.0"
}
],
"authority": [],
"additional": []
}
}
Detect malicious activity early.
DNS reveals early indicators of compromise, including command-and-control callbacks, malware staging, and data exfiltration. High-fidelity DNS telemetry helps security teams detect, investigate, and reconstruct attacker behaviour across systems.
Correlate with known indicators.
DNS activity can be correlated with threat intelligence feeds and suspicious infrastructure, providing context on how domains are used and helping distinguish benign traffic from real threats.
Reveal system dependencies.
Observe how systems communicate in real time, identify service dependencies, troubleshoot resolution failures, and detect unexpected or misconfigured connections.
Identify external communication.
DNS telemetry provides a record of external communication, supporting auditing and investigation by showing which domains were accessed, when, and by which systems.
Windows DNS debug logging writes synchronously to disk at high volume and produces unstructured text output. It was designed for troubleshooting, not continuous telemetry, and introduces significant I/O overhead on production servers.
Packet capture relies on kernel drivers or permanently elevated permissions, increasing attack surface on critical infrastructure. It also requires reconstructing and decoding traffic that the DNS server has already processed, adding complexity and potential visibility gaps.
ETW is the correct telemetry source for Windows DNS. However, most ETW-based tooling captures only query metadata and does not parse the embedded DNS packet data, resulting in incomplete visibility while still adding overhead under load.
Complete DNS visibility
Every response includes the full answer, authority, and additional sections — with all resource records and TTLs intact.
Zero production impact
Passive ETW-based capture introduces no hooks into the DNS service, no latency, and no disruption.
No packet capture required
No kernel drivers. No promiscuous mode. No reassembly. Everything is captured after parsing, inside Windows.
Predictable resource usage
Fixed memory footprint. No disk I/O in the data path. CPU scales with query volume.
The ETW callback fires synchronously for each DNS event. DnsStream reads the structured event fields and hands off immediately to avoid blocking the ETW delivery thread.
Parsed events are placed into a configurable in-memory ring buffer. This decouples capture from forwarding and absorbs bursts in DNS query volume. Buffer size is set in the configuration file.
DNS records are normalised into their familiar textual representation. Unknown types are preserved as hex-encoded RDATA so they remain intact for downstream processing.
A dedicated forwarding thread drains events from the queue, serialises them into the configured output format, and transmits to the configured forwarding target over TCP or TLS.
| Resource | Characteristic | Value | Notes |
|---|---|---|---|
| CPU | dns.exe usage | ~4% | Proportional ratio - scales with query volume |
| CPU | DnsStream usage | ~1% | Proportional ratio - scales with query volume |
| Memory | Process footprint | ~115 MB | Fixed; set by ring buffer size (default 100 MB queue) |
| Throughput | DNS queries consumed | 10,000 qps | Sustained during testing |
| Throughput | Telemetry events forwarded | 20,000 eps | Both the query and its response |
| Network | DNS traffic | 14 Mbps | 7 Mbps inbound and outbound for DNS queries and responses |
| Network | Telemetry forwarding | 70 Mbps | Event forwarding over TLS |
| Disk I/O | Telemetry pipeline writes | None | Entire pipeline operates in memory |
| Disk I/O | Windows Event Log writes | Every 10m | Application metrics; configurable interval |
Fully functional and safe for production use.
Free to use. No licence required.
Full-fidelity DNS telemetry captured directly from the Windows DNS ETW provider. Core and Assured use the same telemetry pipeline with no event-rate limitations.
Download CoreExtends the core telemetry engine with enterprise resilience, authenticated transport, and operational support.
Assured licensing from £950 per DNS server annually.
Designed for larger and operationally critical deployments. Scale to enterprise deployments without changing how DnsStream is deployed or operated.
Request Assured pricingDnsStream Core is fully functional and production-safe.
Organizations adopt Assured when DNS telemetry becomes operationally critical infrastructure and requires stronger guarantees around resilience, transport security, and support. The telemetry pipeline, capture engine, and deployment model remain identical between Core and Assured.
Telemity builds software that collects and forwards telemetry from mission-critical systems - quietly, reliably, and without impacting production.
We focus on the part most systems get wrong: the collection layer. If the data is incomplete, delayed, or unreliable, everything built on top of it is compromised.
We don't do detection. We don't do analytics. We don't bundle enforcement logic into a telemetry agent. We build the foundation those systems depend on - and we build it to the same standards as any other piece of production infrastructure.
"The right telemetry layer doesn't make your SIEM smarter. It makes everything your SIEM does more trustworthy."About Telemity