DNStuki

DNStuki is an open-source software framework for DNS telemetry and analytics. It collects, processes, and analyzes DNS traffic to support security monitoring, performance analysis, and research. The design emphasizes modularity, scalability, and privacy controls, enabling deployment across multiple sites and diverse data sources, including recursive resolvers and enterprise DNS forwarders.

Developed in the early 2020s by a collaboration of operators and researchers, DNStuki reached stable releases by 2022 and has since seen ongoing maintenance and community contributions. The project is hosted publicly, with documentation and example configurations to help operators adopt and adapt it to their environments.

DNStuki uses a pipeline of catalogued modules: collectors, processors, and sinks. Collectors ingest standard DNS messages and encrypted DNS traffic (DoH/DoT); processors enrich data, deduplicate events, and compute simple analytics; sinks export data to files, queues, databases, or SIEMs. A plugin API enables parsers, detectors, and dashboards, with optional REST endpoints.

Typical deployments place collectors near resolvers, with centralized processors and sinks in a secured data lake. The system supports containerized deployment and Kubernetes, supports privacy options such as data masking and access controls, and interoperates with common data sinks like Kafka or time-series databases.

DNStuki is used by several operators and research groups for threat hunting and performance monitoring. It has benefits in visibility but raises concerns about data privacy, governance, and operational complexity in large-scale deployments. It is often discussed alongside other DNS telemetry and analytics solutions.