Monitor DNS queries by IP
If I were running bind on a Unix server, I'd add this to the config file at /etc/named.conf. Not sure how much access Apple gives you to customize the configuration though:

channel query_log {
    file "/var/log/named/query.log" versions 5 size 1m;
    severity dynamic;
    print-time yes;
};
category queries { query_log; };