Audit logging for DNS is generally poorly done. When Vixie's hair was on fire about DoH last summer I wrote this: https://github.com/m3047/shodohflo/

Look in app/ for a screenshot. Needs access to a recursive resolver compiled with support for Dnstap. If you've never paid attention to DNS or used web console (in Firefox) tools, I suspect you're in for a surprise.

Haven't tried it with DoT, I imagine that Dnstap would lose visibility for deciding which client to attribute the traffic to.

(The DNS agent is performant enough for full visibility into a workgroup of 50-100 people.)

Serious enterprises already manage all their endpoints directly, and control their DNS configurations. For that matter, they also run edge TLS proxies and push internal certs to all their machines, so they control HTTPS egress as well.

There are a couple security products that rely on monitoring DNS to function (the "passive DNS" products), and if you're one of those vendors, an industrywide shift to DoH is a real problem. But for everyone else, it's not so much a problem. The same enterprise people raising the alarm over DoH are the ones who tried to break TLS 1.3 to keep the non-forward-secure RSA handshake in the protocol, so their TLS sniffers would keep working. They adapted.

> DNS logs are important in an enterprise. But I'm sure many would want to also use DoH.

Really? Why? As someone who works in academia, I don't see why anyone would need access to my or my colleagues' DNS logs, but I understand things might be different in industry.