Some (fully working) experiments about ServerLevelPluginDll.
DLL installation: dnscmd.exe /config /serverlevelplugindll c:\windows\system32\DNSMon.dll
DNSMon monitors DNS queries on the server and pushes sniffed names to the debug output. You can listen to them using DebugView from Sysinternals.
