INDICATOR-COMPROMISE Suspicious .tk dns query

I've seen the same thing as Edmund.

The link to SNORT is not valid at the time of this posting - returns no results for 39867.

Is this a valid alert still?

Same issue here. It's blocking requests made by my anti-spam system to a blacklist provider.

Is there a way to OK DNS requests to a single domain and leave the rest of the system as is?

you could try to edit this file:

/etc/snort/rules/astaro.rules

Remove this line:

drop udp $HOME_NET any -> any 53 (msg:"D INDICATOR-COMPROMISE Suspicious .tk dns query " group="241"; flow:to_server; byte_test:1,!&,0xF8,2; content:"|02|tk|00|"; fast_pattern:only; metadata:policy security-ips drop, service dns; classtype:trojan-activity; sid:39867;)

I don't know how long this lasts, probably until next pattern update...

you could try to edit this file:

/etc/snort/rules/astaro.rules

Remove this line:

drop udp $HOME_NET any -> any 53 (msg:"D INDICATOR-COMPROMISE Suspicious .tk dns query " group="241"; flow:to_server; byte_test:1,!&,0xF8,2; content:"|02|tk|00|"; fast_pattern:only; metadata:policy security-ips drop, service dns; classtype:trojan-activity; sid:39867;)

I don't know how long this lasts, probably until next pattern update...