Yeah, I get that, too. I use Cloudflare and have a bypass domain to view/edit my site. If I visit "cloudflaredirect.example.com", it'll trigger that DNS warning. I can see that your warnings show blog1 and www, which is similar to what triggers mine.
Following a WordFence suggestion from some other post, I've turned off the DNS scan.
