add parens around (tcp port 53 or ... )