Some (fully working) experiments about ServerLevelPluginDll.

DLL installation: dnscmd.exe /config /serverlevelplugindll c:\windows\system32\DNSMon.dll

DNSMon monitors DNS queries on the server and pushes sniffed names to the debug output. You can listen to them using DebugView from Sysinternals.