If you are using Tor properly, DNS will not leak and they will be able to see you're connecting to Tor, but not where you're connecting to over Tor. Clearly if someone upstream was able to sniff DNS to discover a Tor users intended destination that would be a huge defeat.
That said, it is known to happen. Many applications fail to use proxy settings properly. They might, for example perform a DNS resolve locally then ask Tor to connect to an IP directly, this not only breaks their ability to utilise onion services, it also constitutes a leak of DNS. Intelligence agencies were looking for such leaks since at least 2011.
Tor Browser, Tor Messenger and other applications that are well designed for use with Tor will take steps to ensure that the proxy settings are employed at all times a property the Tor Browser Design Specification calls Proxy Obedience
In such cases, Tor can provide a
DNSPort which is a minimal DNS server (it handles on
PTR records) run by the
tor daemon which will allow you to perform basic DNS resolve over Tor. Note that the Windows resolving proceedure is complex and changes frequently and would require further steps to avoid leaks.
So, if the application does not properly utilise SOCKS5 with remote hostname lookup or SOCKS4a then it's possible that some upstream observer would see DNS requests.
Anyone with network visibility of the connection between the application using Tor and the Tor daemon will be able to see all the Tor traffic, before it was protected. Anyone upstream, (between the Tor daemon and it's Guard or Bridge) would only see that they were using Tor, assuming it was using Tor properly (see: Proxy Obedience).