nat: Only block A queries to HE's DNS server