I don't think you really appreciate the scale of the problem, when any protocol can be used. Port/IP blocks simply are too blunt now, and once again you are screwed if app provider uses the same IP for illegitimate DNS as legitimate services - you might not be able to block the IP at all and still access the services you need on that device or application. To give one example - imagine if netflix shared video on same IP as their private DNS service. They could even use the same port. Can't block the DNS without blocking the service.
Heaven forbid they use dynamic IP/port allocations too...
Heaven forbid they use dynamic IP/port allocations too...