Hello Hans,
This is a field that needs much further study. In general, I think there should be some correlation between the two, but it could just as well be that there is a noticeable discrepancy.
E.g., depending on what DNS resolver services are predominantly used in a specific country, mostly ISP-provided ones, or more of the global open resolver services. In the former case, many clients could be fed by a very small number of DNS resolver instances the same cached DNS response while it is valid, leading to the DNS volume underrepresenting the actual NTP traffic volume. In the latter case, with the typical anycast setup of those services actually hiding that there is a multitude of independent server instances each with their own cache, and with multiple such services available, each with their own proprietary internal setup and inner workings, this could generate a higher level of DNS queries seen, and counted by the pool.
And some of those global open resolvers support user privacy, i.e., it is more difficult for the pool to assess the actual location of a client. This increases the risk of “misplacing” the NTP clients country-wise, e.g., when the DNS request is routed to an anycast instance in another country, the pool is likely to count it as coming from the country the DNS server instance is located in, rather than the client.
And some ISP DNS resolvers mess with the lifetime of cached DNS reponses. E.g., Alibaba Cloud for some reason sets the TTL to 10 seconds in all responses, regardless of the value sent by the origin. I don’t know whether the resolver itself also caches responses only for ten seconds. Either way, that is bound to probably skew the relation between number of DNS queries, and actual NTP traffic, in some way for zones with Alibaba Cloud locations, as compared to other zones.
Or what type of NTP client implementation is prevalent in a country. SNTP clients tend to create more DNS traffic in relation to NTP traffic they create than NTP clients, so if the predominant type of device in one country has one type of client in it, and the predominant type of device in another country has the other type of client in it, that is bound to skew the results in one way or another.
So, many factors playing a role, making it difficult to determine exactly how the number of DNS queries correlates with the amount of NTP traffic, many open questions, thus interesting observations that are difficult to explain, e.g. why the predominant IPv6 NTP traffic for both my NL as well as LT server is from Germany (in terms of number of individual clients, not traffic volume). (By the way, traffic from Austria is second on my LT instance, while traffic from Lithuania itself is only in seventh place - though all with veeery low IPv6 NTP traffic overall.) Or why, as I understand it, you are seeing a higher proportion of actual traffic from DE than the DNS query counts would suggest.
It is just for your server, as collected by the pool.
See this explanation.