@StrongwaterSec log DNS passively with taps in front of all resolvers and trust perimeters. tshark -nt ad -i nic -f ‘port 53’ is too easy.