Re: "AND the header-level clues that DNS resolution is being requested."
There will be several hints and statistical techniques revealing that's a DNS request
Lets start with the SNI header !
But I agree with others - it's going to be one real cluster-duck when it comes to debugging the problems that DO occur on a routine basis.