oh man. basically everything. Malware, phishing, c2, wateringhole, etc. Just about anything an endpoint is talking to is captured in dns logs.