It only blocks IPv4 traffic, so on an IPv6 enabled host it can easily be bypassed without even involving DNS. But assuming an IPv4-only host, on a system using nscd, DNS lookup is performed over a Unix socket:

    Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination
       23  1445 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            owner UID match 1007
    
    # setuidgid outtest ping -n 1 -4 google.com
    PING google.com (142.250.102.100) 56(124) bytes of data.