If anything hits port 53 on the outgoing gateway, and it's not from our recursive servers, then we know that network element needs to be looked at: either it's mis-configured or malicious.

Anything that uses our recursive servers is monitored, and we can check against blacklists, either in real-time or after-the-fact through logging.

* https://en.wikipedia.org/wiki/Domain_generation_algorithm

* https://en.wikipedia.org/wiki/Botnet#Domains

If malware is connecting to hard-coded IPs then there's nothing we can do about that.

So yes: monitoring DNS for suspicious activity is part of our security strategy.

Then your security strategy definitely needs improvements, since malware often uses hardcoded IPs to bypass DNS proxying/forwarding that corporate networks use. Seriously, this argument could be used to say we should be using HTTP instead of HTTPS, but anyone doing security knows if they really need that level of introspection they need to MITM HTTPS traffic with a MITM proxy. If you care that much, you also need to MITM DoH/DoT traffic.

DNS sniffing takes care of a lot of low-hanging fruit.

Given that Cisco has a major product, Umbrella, that is sold as a part of enterprise security strategy I'd say that more than the OP is considering DNS filtering / monitoring as part of a network security strategy.