For publicly-accessible infrastructure: 4-6 instances of pdns authoritative for a domain, and pdns recursor running locally for each box. And Cloudflare free

For publicly-accessible infrastructure: 4-6 instances of pdns authoritative for a domain, and pdns recursor running locally for each box. And Cloudflare free tier while revenue can't justify rolling-out Varnish and other locally-deployed capacity/DDoS mitigations. It may also be a better idea to push DNS updates via configuration management or driven from something like Envoy so there's a history and a single-source-of-truth (SSOT) to point-to rather than multiple people doing manual tinkering, which is a labor-intensive, antiquated approach.