DNS Notes:
Get-ETWProvider | ? { $_.Name -match 'DNS' }

Only Microsoft-Windows-DNS-Client has keywords

Get Keywords:
Get-ETWProvider | ? { $_.Name -match 'Microsoft-Windows-DNS-Client' } | % { $_.Keywords }

This returns:
Name                           Value DisplayName
----                           ----- -----------
ut:GenericEvent                  256
ut:DnsAutoLogKeyword       268435456
ut:SendPath               4294967296
ut:ReceivePath            8589934592
ut:L3ConnectPath         17179869184
ut:L2ConnectPath         34359738368
ut:ClosePath             68719476736
ut:Authentication       137438953472
ut:Configuration        274877906944
ut:Global               549755813888
ut:Dropped             1099511627776
ut:PiiPresent          2199023255552
ut:Packet              4398046511104
ut:Address             8796093022208
ut:StdTemplateHint    17592186044416
ut:PolicyTable        35184372088832
ut:PerfCheckPoints    70368744177664
ut:RegistrationEvent 140737488355328

Creating an ETL file using this provider:
Start-ETWSession -ProviderName Microsoft-Windows-DNS-Client -OutputFile $env:temp\dnsout.etl -SessionName DNS-01

Above starts the session without any keywords. There is a Keywords argument, but I have not tried it yet.

Stopping the session:
Stop-ETWSession -SessionName DNS-01

Get-WinEvent may be used to read the ETL file (note: -Oldest is required):
Get-WinEvent -Path $env:temp\dnsout.etl -Oldest

There are likey other ways to read this file, I'm still investigating, but the above works.

ToDo: How can we create a session in memory, without writing to disk and have a "listener" that monitors for events we'e interested in?

This can be used to enumerate the methods on the given assembly, in this case Microsoft.Diagnostics.Tracing.TraceEvent:

try {
    import-module X:\PSalander\EventTrace\lib\Microsoft.Diagnostics.Tracing.TraceEvent.dll
    [Microsoft.Diagnostics.Tracing.TraceEvent].GetMethods() | Select-Object -ExpandProperty Name |
    Foreach-Object {
        [Microsoft.Diagnostics.Tracing.TraceEvent].GetMethod($_) | Select Name
    }
} catch {
    $_
} Finally {
    Remove-Module Microsoft.Diagnostics.Tracing.TraceEvent
}

This does throw an exception on EventData because there are two EventData methods, resulting in an ambiguous call.

PIDs in the ETL file for dns lookups correspond to svchost processes.

Ids     Purpose
1001    