If you just up the ante in managed networks, you will end up with two choices: a) https proxy, custom CA certificate and filtered DNS anyway, or b) no interne

If you just up the ante in managed networks, you will end up with two choices: a) https proxy, custom CA certificate and filtered DNS anyway, or b) no internet access. I would rather not end up that far. Just internal resolver won't help you, when the apps (not systems, apps) are ignoring it.