DNS TAPIR

A privacy-preserving operational platform for DNS threat detection and shared situational awareness

DNS query telemetry is increasingly collected into isolated commercial or governmental analysis ecosystems where sensitive operational and privacy-related information may be exposed outside the control of Internet service providers and DNS resolver operators. DNS TAPIR explores an alternative approach: collaborative DNS threat analysis without unnecessary centralisation of sensitive DNS telemetry.

The platform combines:

• local privacy-preserving DNS telemetry processing,
• shared analytical capability,
• operational intelligence exchange,
• and continuously evolving analytical methods.

The DNS TAPIR (DNS Threat and Privacy Internet Research) team consists of leading DNS experts and developers, with many years of combined experience of operating DNS resolvers and threat analysis.

Why DNS matters

DNS is one of the earliest observable indicators of malicious activity on the Internet. Threat actors frequently rely on DNS infrastructure for:

• malware command-and-control,
• phishing infrastructure,
• ransomware operations,
• botnet coordination,
• and rapidly changing attack infrastructure.

At the same time, many organisations struggle to independently maintain advanced DNS-analysis capability due to limited staffing, fragmented operational visibility, and increasing analytical complexity.

DNS TAPIR enables participating organisations to benefit from shared analytical capability, continuous analytical research, broader situational awareness, and privacy-preserving operational collaboration.

Privacy and operational resilience

DNS telemetry may contain both privacy-sensitive and operationally sensitive information. DNS TAPIR is therefore designed around:

• local analysis
• minimisation before sharing
• controlled federation
• and participant-controlled governance.

This aligns with increasing operational resilience expectations emerging through frameworks such as GDPR and NIS2.

Current status

DNS TAPIR has:

• completed proof-of-concept development
• entered operational test environments
• established collaboration with Swedish Internet service providers
• and is transitioning toward sustained operational capability.