Audit logging for DNS is generally poorly done. When Vixie's hair was on fire about DoH last summer I wrote this: https://github.com/m3047/shodohflo/ https://gi

Audit logging for DNS is generally poorly done. When Vixie's hair was on fire about DoH last summer I wrote this: https://github.com/m3047/shodohflo/ https://github.com/m3047/shodohflo/ Look in app/ for a screenshot. Needs access to a recursive resolver compiled with support for Dnstap. If you've never paid attention to DNS or used web console (in Firefox) tools, I suspect you're in for a surprise. Haven't tried it with DoT, I imagine that Dnstap would lose visibility for deciding which client to attribute the traffic to. (The DNS agent is performant enough for full visibility into a workgroup of 50-100 people.)