add filter rule for empty dns hijack