This seems like an authoritarian argument rather than cybersecurity. It’s hard to say what’s a valid or not valid argument, but I think if a university is trying to limit malware, then blocking DNS won’t do too much.