If you have that kind of security profile that you need to lock down what ip addresses that can make a port 80 connection, and can't use the api of the dns prov

If you have that kind of security profile that you need to lock down what ip addresses that can make a port 80 connection, and can't use the api of the dns provider because of security considerations, then how is giving a third party dns provider full control of DNS acceptable within the threat model? Run your own DNS server and get a registrar lock. If that is not feasible, and consultants are too expensive, I would look into the more expensive dns providers that provide custom interface that fit the threat model of your system. If that is also too expensive then I would take a second look at the risk analysis and recalculate the cost of each risk.