Running the authoritative dns for the zone seems elegant, although wouldn’t that imply you absolutely can’t use cloudflare or similar services to avoid ddos/bots?