What happens when the traffic log shows an internal host attempting to open a session to a properly configured sinkhole address?

The sinkhole process redirects DNS resolution for malicious domains; it doesn't involve the internal host connecting to a rogue DNS server directly in this scenario.

This scenario describes external malicious traffic attempting to reach an internal DNS server, which is unrelated to an internal host connecting to a sinkhole address.

The sinkhole address is the *target* IP that malicious domains resolve to, not an address used by a rogue DNS server to *direct* traffic to a malicious domain. The sinkhole itself is the protective measure.

A sinkhole is a security mechanism where DNS queries for known malicious domains are intentionally resolved to a non-existent or a specific internal IP address (the sinkhole address). If an internal host then tries to establish a connection to that sinkhole IP, it signifies that the host attempted to access a known malicious domain, and the sinkhole mechanism intercepted the attempt, logging it as a security event.