Split DNS zones really suck when you have a thousand "privacy enhancing" settings that silently bypass your network assigned resolvers.