Comment by cortesoft

They could block all outgoing traffic to port 53, although you could work around that by setting up a DNS server on a different port outside the network