Out of interest I looked into it.  Just a few comments below.

On 04/02/2026 13.37, Giles Crawford wrote:
network:
  address-renumbering:
  # If DNS answer is %source%, change it to %dest%
  # Works great but logically better under local-data:?
    - source: x.x.x.x/32
      destination: y.y.y.y

Right.  Well, this also needs a better implementation and making .rpz-ip rules fill that.  It's on the heap of RPZ-related plans.  This old renumbering module just isn't efficient, as for each address in reply it iterates over each (!) renumbering rule (in Lua).

logging:
  level: info
  # crit|err|warning|notice|info|debug
  target: syslog
  # Can target directory be specified?
  dnstap:
    enable: false
    unix-socket: /tmp/dnstap.sock
    # by default log is disabled for all
    log-queries: true
    log-responses: true
    # Nice - Also possible to enable/disable this
    # for general logging, without adjusting the
    # logging level?

The syslog-like logging can only be done to syslog, stdout or stderr so far, not files.  You can see that e.g. in docs:
https://www.knot-resolver.cz/documentation/latest/config-logging-monitoring.html#cmdoption-arg-target

Some extra logging (to the configured target: syslog) can be done by the old lua policies (entered via /lua/script into YAML); nothing ergonomic yet:
https://www.knot-resolver.cz/documentation/latest/dev/modules-policy.html#actions-for-extra-logging