Zero trust or bust. I actually cringed when I read "done right" applied to split-horizon DNS.