If a server is configured as DNS server ingest the logs for the service. This is listed in CIS v8.1, Safeguard 8.6.