We have a simple setup: Some workstations (Mac and Linux) and a gateway router. For statistics and security purposes I want to watch all DNS queries done in our intranet. Unfortunately the gateway router is not capable of logging DNS traffic in a sufficient manner. What is the best way to accomplish this?
Setup a DNS server on hardware, and enable logging. Force all your clients to use it with configuration combined with firewall rules blocking clients from access DNS servers other then your DNS server.
@Zoredache's answer is the ideal answer for long term monitoring (and control) but for short term monitoring there is the widely available
Capturing packets or reading a pcap file, it can display domains broken down by zone level, query and response types, and other fun oddities.