Vixie will not like this, for sure. Another way to do this is to use your HTTP and DNS logs to "triangulate" seen user IPs with seen resolver IPs. It's surprising how many DNS resolvers are ill-placed with regards to their clients.