This, but if your op-sec is strict enough, have unique DNS servers per security domain; possibly just a simple local caching server that is forced to work throu

This, but if your op-sec is strict enough, have unique DNS servers per security domain; possibly just a simple local caching server that is forced to work through the intended public face.