global:
  trace:
    verbose: true

pipelines:
  - name: tap
    dnstap:
      listen-ip: 0.0.0.0
      listen-port: 6000
    transforms:
      normalize:
        qname-lowercase: true
        qname-replace-nonprintable: true
    routing-policy:
      forward: [ detect_new_domain ]
      dropped: [ ]

  - name: detect_new_domain
    dnsmessage:
      matching:
        include:
          dnstap.operation: "CLIENT_QUERY"
    transforms:
      new-domain-tracker:
        ttl: 3600
        cache-size: 1000
    routing-policy:
      forward: [ console ]
      dropped: [  ]

  - name: console
    stdout:
      mode: text