dns/resolve rules clearification question

[c33s]

baseinfo: my opensnitch is set to create 12h deny rules by default as i don't like the focus-grab of the popup.

when a tool like ssh-keyscan or python or pyinfra needs to resolve a domain, a rule is created where the domain to resolve is in the To this host field.

is this intended? this is quite confusing, i would want to see which dns server is the process connecting to. or course it is a nice feature to allow to block dns resolutions by name but shouln't that be in its dedicated field? what does it mean, is it only a misuse/multi-use of the To this host field or is something wrong?

how to allow the connection to a specific dns server or block dns resolution through a specific server? for example i would like that all dns queries are handled by my LAN dns server and are not handled by google (8.8.8.8). how to prevent that? is that even possible?

cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 192.168.0.1

maybe related to #1364

edit: is it safe to allow access to port 53 without protocoll and without domain and that means only domain resolving is allowed or does this also allow this executable can also connect EVERYWHERE to port 53 no matter what protocoll and what host/ip?