I'm somewhat more comfortable with making ACL changes because they have tests I can write in the ACLs themselves, plus I can specifically target users with new

I'm somewhat more comfortable with making ACL changes because they have tests I can write in the ACLs themselves, plus I can specifically target users with new ACLs. I'm more concerned about making any DNS changes at all. Or adding/modifying subnet routers.