add new rule: DROP DNS Q doc.gov (m.b. new victim)

add doc.gov (m.b. new victim) - added temporarily