I use a wildcard for mine. *.locallan.domain.com It exposes part of the domain, but none of the services. If you want to be even more secure, you could null-I

I use a wildcard for mine. *.locallan.domain.com It exposes part of the domain, but none of the services. If you want to be even more secure, you could null-IP the wildcard and only allocate IPs for subdomains that you use.