Exactaly right. You should assume, especially in an environment like the NSA, that your internet browsing and email correspondence is being monitored and certain hosts and suspicious DNS will trigger something.

I've worked at far less security concerned companies that monitored all network traffic going and out and logged it and continually were looking not only for internal nefarious behavior but for possibly viruses, worms, etc.