@atom deeper discussion around collecting dns logs, but long story short is its not an easy problem to solve with a guarantee that you have proper settings. Something that enforces the state of the machine is necessary to do that (config management of some sort). That said, osquery can do well to tell you how well your config management is working