I can only do that on devices/clients I control [1]. Often that's not an option and have to create workarounds on network level (for DNS). Because I might not

I can only do that on devices/clients I control [1]. Often that's not an option and have to create workarounds on network level (for DNS). Because I might not have a say on what device is running, but if it can't resolve internal systems its my problem. DNSSEC is going to make my life even more interesting.