these memory thresholds dont really have any way to adust to what is normal for your deployment - take the 400M over with a grain of salt initially.
The more important thing will be if the value is climbing which may be indicative of a memory leak. You can monitor the output of "show memory debug" and "show memory mdns" over a couple of days to see what its behavior is (similarly you can view the controller overall memory use if you have airwave, how is it behaving over 3 days or a week)
if this is just heavy mdns usage the value should be quite static, if the value is climbing each day and not receding when the busy peak of the day is over then you may have a leak (wont be the first one mdns has seen).
heavy mem usage in mdns is expected if you have a lot of mdns devices in the network, it probably shouldnt cause impact to end devices unless something is full or taking too long, the logs may give a clue to that.
first things first - is it stable or increasing monotonically? how does it behave over a longer term ?