ZBF and DNS?

My 887 router will be a DNS server, I have ZBF. I have to open the port to allow traffic from the DNS server.

<code>   
Jun 14 18:23:50.438: %FW-6-DROP_PKT: Dropping udp session 208.67.220.220:53 172.16.1.23:51872 on zone-pair OUTSIDE-TO-SELF class class-default und in policy-map with ip ident 0
</code>

I created an ACL and included it in a class map with 'pass'. It did not work. It worked when I opened ALL udp from this IP?

<code>   
Extended IP access list DNS
    10 permit udp host 208.67.220.220 any eq domain
    20 permit udp host 8.8.8.8 any eq domain
    30 permit udp host 208.67.220.220 any (7 matches)
</code>

<strong>Why is line 10 not working?</strong>