Is this a spoofed SYN flood?
At first glance, this may look like an attack. An attacker can initiate a SYN Flood without using his real IP address. An attacker crafts a packet with an origin IP of a known IP such as that of a blackhole dns server. Your server may exhaust resources while attempting to respond with a SYN-ACK packet.
How can I tell
If your server does respond with a SYN-ACK packet, then the original packet is likely spoofed if the server doesn't respond with a final ACK packet.
Why am I seeing TCP traffic for DNS?
A request sent to one of these servers will result in a response being returned to the client. The response will typically be a UDP datagram, although it's perfectly valid for requests to be made over TCP. In both cases, the source port of packets returning to the site that originated the DNS request will be 53.
Explanations provided by RFC6305
Section 6 of RFC6305 provides further explanations of why you may see this traffic.
Inbound Traffic from AS112 Servers
Where firewalls or intrusion detection systems (IDSs) are
configured to block traffic received from AS112 servers,
superficial review of the traffic may seem alarming to site
Since requests directed ultimately to AS112 servers are usually
triggered automatically by applications, review of firewall logs
may indicate a large number of policy violations occurring over an
extended period of time.
Where responses from AS112 servers are blocked by firewalls, hosts
will often retry, often with a relatively high frequency. This
can cause inbound traffic to be misclassified as a denial-of-
service (DoS) attack. In some cases, the source ports used by
individual hosts for successive retries increase in a predictable
fashion (e.g. monotonically), which can cause the replies from the
AS112 server to resemble a port scan.
A site administrator may attempt to perform active measurement of
the remote host in response to alarms raised by inbound traffic,
e.g. initiating a port scan in order to gather information about
the host which is apparently attacking the site. Such a scan will
usually result in additional inbound traffic to the site
performing the measurement, e.g., an apparent flood of ICMP
messages that may trigger additional firewall alarms and obfuscate
the process of identifying the originally problematic traffic.