One of the best network security tools for passively collecting DNS records, as well as facilitating incident handling, Network Security Monitoring (NSM) and general digital expertise.
PassiveDNS monitors traffic from the interface or reads the rar file and outputs the DNS server responses to the log file. Passive DNS can cache/aggregate duplicate DNS responses in memory, limiting the amount of data in the log file without losing value in the DNS response.

A network sniffer that logs all DNS server replies for use in a passive DNS setup - GitHub - gamelinux/passivedns: A network sniffer that logs all DNS server replies for use in a passive DNS setup