If you do not have internal DNS servers, or have internal DNS servers that forward all the queries (DNS caches), you do not need to create DNS rules the other way (e.g. rules for the inside).
The Firewall builds an internal table, that will accept in the way in the answers to the internal requests that were allowed to get out by your defined rules/policies. The technology that allows this is called "stateful Firewall", and is pretty much ubiquitous nowadays. Cisco, Checkpoint, iptables have implemented it for ages now.
In computing, a stateful firewall is a network firewall that tracks
the operating state and characteristics of network connections
traversing it. The firewall is configured to distinguish legitimate
packets for different types of connections.
What do you need to change, is that DNS do not only works in UDP, but also in TCP. So besides port 53/UDP, you have to allow port 53/TCP out.
Not doing that can cause you problems with some operations in the Internet, as DNS can fall back for TCP for giving longer answers.
From Is it true that a nameserver have to answer queries over TCP?
TCP is not just for zone transfers.
DNS server implementations are now "required" (in so much as any RFC
requires anything) to support TCP, per RFC 5966, "DNS Transport over
TCP - Implementation Requirements".
That said, if your particular DNS servers are not configured to
support TCP, or if it is blocked, then the longer term effect will be
an inability to support DNSSEC correctly. Similarly any other DNS data
which causes responses to exceed 512 bytes might be blocked.
As for DNS packets dropped that are dropped in the way in, after you have the TCP rule, they are scanning tries. Ignore them. As for other dropped DNS packets to IPs that are not your DNS forwarders, definitively ignore them.
