You need proto udp
Actually DNS can use both (tcp and udp) but I haven't seen tcp ever (But, you know, I'm not sys admin either)
Also you need to pass packets out. I don't remember how to do this correctly with pf, either add keep state or make another rule, to pass dns out.
I think keep state...