I recently attempted to trace exactly which app is making a particular DNS SOA query. I can confidently say that there are very few applications in the *nix space that do proper DNS reporting at all, and Little Snitch seems to be the only one that would map the actual app. I found no working solution to match a query to a pid in Linux.

This tells me that either people rarely need to do this, or that it’s very hard to do in userland.