f they are not a DBA they should have never been given the DBA role.
utl_http is granted to "public" by default. you can revoke it from "public" and explicitly granted to each oracle user "per need".
also, you need to verify that the 'DBA' role will grant "utl_http" to the user. the easiest way to list the 'DBA' role permissions is using a GUI like TOAD or sql developer. it will list all privileges under 'DBA' role ( for example, create any table, create any view ,....etc)
