You know, sometimes the simpler solutions work best. I like this one. I'm sitting here contrasting this against my normal approach* and the approach here is:

You know, sometimes the simpler solutions work best. I like this one. I'm sitting here contrasting this against my normal approach* and the approach here is: 1) easier to explain to others 2) self documenting 3) just as effective as running a caching nameserver * i have vm hosts configured in CM to have a bunch of promises applied, one of them is to run a caching nameserver, these hosts are the only ones allowed to do zone transfers. The vm instances running on top of these have a promise applied which has them use their underlying dom0 for dns queries.