Assuming you're already collecting network metadata (either from Stream, your proxy server, firewall logs, etc.) then you just need to look for events going to port 53 with a destination IP address not in your network.
---
If this reply helps you, Karma would be appreciated.
