Which command, run in a Cilium agent pod, lists the domain names and IPs that toFQDNs policies have learned?

Answer: cilium-dbg fqdn cache list

Explanation

cilium-dbg fqdn cache list shows each endpoint's DNS lookups with the name, TTL, expiry time and IPs. Run it in the agent on the same node as the pod, since each agent only sees the DNS traffic of its own node. A missing name means the DNS proxy never saw the lookup.