diff --git a/pkgs/tools/networking/dnsviz/default.nix b/pkgs/tools/networking/dnsviz/default.nix
new file mode 100644
index 000000000000..1f33855017d3
--- /dev/null
+++ b/pkgs/tools/networking/dnsviz/default.nix
@@ -0,0 +1,51 @@
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, dnspython
+, m2crypto
+, pygraphviz
+}:
+
+buildPythonApplication rec {
+  pname = "dnsviz";
+  version = "0.9.2";
+
+  src = fetchFromGitHub {
+    owner = "dnsviz";
+    repo = "dnsviz";
+    rev = "v${version}";
+    sha256 = "sha256-tIxjlNtncZJSdfQelIR9fTohBDkyC0+YwEcs2gNfKec=";
+  };
+
+  patches = [
+    # override DNSVIZ_INSTALL_PREFIX with $out
+    ./fix-path.patch
+  ];
+
+  propagatedBuildInputs = [
+    dnspython
+    m2crypto
+    pygraphviz
+  ];
+
+  postPatch = ''
+    substituteInPlace dnsviz/config.py.in --replace '@out@' $out
+  '';
+
+  # Tests require network connection and /etc/resolv.conf
+  doCheck = false;
+
+  pythonImportsCheck = [ "dnsviz" ];
+
+  meta = with lib; {
+    description = "Tool suite for analyzing and visualizing DNS and DNSSEC behavior";
+    longDescription = ''
+      DNSViz is a tool suite for analysis and visualization of Domain Name System (DNS) behavior,
+      including its security extensions (DNSSEC).
+
+      This tool suite powers the Web-based analysis available at https://dnsviz.net/
+    '';
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ jojosch ];
+  };
+}
diff --git a/pkgs/tools/networking/dnsviz/fix-path.patch b/pkgs/tools/networking/dnsviz/fix-path.patch
new file mode 100644
index 000000000000..7906058cd98e
--- /dev/null
+++ b/pkgs/tools/networking/dnsviz/fix-path.patch
@@ -0,0 +1,18 @@
+diff --git a/dnsviz/config.py.in b/dnsviz/config.py.in
+index 373fde2..007f0f1 100644
+--- a/dnsviz/config.py.in
++++ b/dnsviz/config.py.in
+@@ -26,12 +26,7 @@ from __future__ import unicode_literals
+ import os
+ import sys
+ 
+-_prefix = '__DNSVIZ_INSTALL_PREFIX__'
+-if (hasattr(sys, 'real_prefix') or hasattr(sys, 'base_prefix')) and \
+-        not _prefix:
+-    DNSVIZ_INSTALL_PREFIX = sys.prefix
+-else:
+-    DNSVIZ_INSTALL_PREFIX = _prefix
++DNSVIZ_INSTALL_PREFIX = "@out@"
+ DNSVIZ_SHARE_PATH = os.path.join(DNSVIZ_INSTALL_PREFIX, 'share', 'dnsviz')
+ JQUERY_PATH = __JQUERY_PATH__
+ JQUERY_UI_PATH = __JQUERY_UI_PATH__
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3a60a51f698e..a6d0d76f4b30 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3665,6 +3665,8 @@ in
 
   dnstop = callPackage ../tools/networking/dnstop { };
 
+  dnsviz = python3Packages.callPackage ../tools/networking/dnsviz { };
+
   dnsx = callPackage ../tools/security/dnsx { };
 
   dhcp = callPackage ../tools/networking/dhcp { };