DNS hygiene notes for a zero-trust network

Visibility

Log queries at resolvers you control. Unexpected NXDOMAIN bursts often precede larger issues.

Policy

Align internal zones with device trust signals; avoid flat internal DNS that mirrors the public internet blindly.