How do you prove no clients still use an old DNS resolver before retiring it?

Changing DHCP and static configuration does not prove every client moved. Appliances, containers, VPN profiles, hard-coded application settings, and systems that rarely boot can keep querying the old resolver long after the main fleet appears clean. Query logs help, but caching and long idle periods make a quiet server ambiguous.

What evidence do you collect before shutdown? My rough plan is to keep the old address alive through more than the longest lease cycle, log source IPs and query timestamps, compare DHCP and configuration-management state, lower any relevant TTLs, and then move the address to a monitored sink or forwarding resolver before removing it completely. That should expose late clients without immediately breaking resolution.

How long do you observe, and how do you account for NAT, privacy addresses, split DNS, and devices that only appear during maintenance or disaster recovery? Is there a better final test than firewalling the old resolver in stages and watching for failures?