Unexpected DNS server alert

Hello Team,
I'm trying to trigger the "Unexpercted DNS server" alert in my environment, but it's working only when DNS requests are based on TCP, when DNSnrequest are UDP based protocol is not recognised and the destination port is marked as "unknown".
Here is my environment, the "netflow-server1" is the ntop/nprobe server, the virtual cisco router in the middle is sending netflow record to it:

Here is the result of the DNS UDP flow:

Here is the result of the DNS TCP flow:

I'm attaching here the pcap (dnsRequestsUDP.pcapng) with the DNS requests based on UDP (no alert triggered), the pcap (dnsRequestsTCP.pcapng) with the DNS requests based on TCP (alert triggered) and the netflow capture that goes from the cisco router to the netflow server (UDP and TCP) (netflowUDP.pcapng and netflowTCP.pcapng)
Kindly help me to understand what is missing on the netflow record that "summarized" the DNS requests, the ip protocol 17 (UDP) and the destination port 53 are present.

*A sample CFLOW packet that contain the UDP DNS request based is the 7 (netflowUDP.pcapng)
**A sample CFLOW packet that contain the TCP DNS request based is the 73 (netflowTCP.pcapng)

Grazie
Davide