dnscap is a network capture utility designed specifically for DNS
traffic.  It normally produces binary data in pcap(3) format, either
on standard output or in successive dump files (based on the -w
command line option.)  This utility is similar to tcpdump(1), but
has finer grained packet recognition tailored to DNS transactions
and protocol options.  dnscap is expected to be used for gathering
continuous research or audit traces.

WWW: https://www.dns-oarc.net/tools/dnscap