No problem. If you run into issues, it could be that your particular DNS server may put the result code in a different part of the packet. If that is so, simply use

  tcpdump -p -i interface -NNnn -s0 -c100 -SeX port 53

and look for the 8400 and 8500 hex codes and what the number in the far left column is. Then adjust iptables accordingly to look in that part of the packet.

Another way to do this is to modify the source code of the DNS server, but I found that to be too time consuming.

Disclaimer: I should also add that the above method of using iptables to drop anything we do not know about does violate some RFC's and instead follows the thing our Mom's taught us, "If you don't have anything nice to say...". That said, you would have to decide if bending some RFC's is ok. In a Corporate environment it can lead to confusion and time lost troubleshooting.