snort (SID 43687) blocks root DNS servers ?!