1 files changed, 61 insertions, 0 deletions
diff --git a/plugin/dnstap/README.md b/plugin/dnstap/README.md
new file mode 100644
index 000000000..d91c9422c
--- /dev/null
+++ b/plugin/dnstap/README.md
@@ -0,0 +1,61 @@
+# dnstap
+
+*dnstap* enables logging to dnstap, a flexible, structured binary log format for DNS software: http://dnstap.info.
+
+There is a buffer, expect at least 13 requests before the server sends its dnstap messages to the socket.
+
+## Syntax
+
+~~~ txt
+dnstap SOCKET [full]
+~~~
+
+* **SOCKET** is the socket path supplied to the dnstap command line tool.
+* `full` to include the wire-format DNS message.
+
+## Examples
+
+Log information about client requests and responses to */tmp/dnstap.sock*.
+
+~~~ txt
+dnstap /tmp/dnstap.sock
+~~~
+
+Log information including the wire-format DNS message about client requests and responses to */tmp/dnstap.sock*.
+
+~~~ txt
+dnstap unix:///tmp/dnstap.sock full
+~~~
+
+Log to a remote endpoint.
+
+~~~ txt
+dnstap tcp://127.0.0.1:6000 full
+~~~
+
+## Dnstap command line tool
+
+~~~ sh
+go get github.com/dnstap/golang-dnstap
+cd $GOPATH/src/github.com/dnstap/golang-dnstap/dnstap
+go build
+./dnstap
+~~~
+
+The following command listens on the given socket and decodes messages to stdout.
+
+~~~ sh
+dnstap -u /tmp/dnstap.sock
+~~~
+
+The following command listens on the given socket and saves message payloads to a binary dnstap-format log file.
+
+~~~ sh
+dnstap -u /tmp/dnstap.sock -w /tmp/test.dnstap
+~~~
+
+Listen for dnstap messages on port 6000.
+
+~~~ sh
+dnstap -l 127.0.0.1:6000
+~~~