I use a similar setup. The "whitelist" is a zone served by a local authoritative server like tinydns or nsd. There is no remote server. Using a local cache s

I use a similar setup. The "whitelist" is a zone served by a local authoritative server like tinydns or nsd. There is no remote server. Using a local cache such as dnscache or unbound is optional. Spotting queries to an attacker-controlled domain in the tinydns logs would be easy. The tinydns logs are invaluable for determining what domains our servers and applications actually need to function... versus the ones that serve the interests of third parties for telemetry, ads, tracking, etc.