Or is it possible you're using End User Notification Pages and your users are mistaking the DNS failure notification for the site being blocked?  I know we've had to deal with plenty of calls where this was the case - we use our own custom corporate...