Regarding DNS forwarding.. I'm not far off giving up myself. We have DNS servers acting as recursive servers across the enterprise, and there's a bikeshed every few months about how it needs to forward to Google. Multiple external consultants have come in and explained that having a 1500 user enterprise refer to our own DNS servers will be just dog slow, because actually returning a cached result is apparently something only Google and Cloudflare can do.

I'm tired. I want to go make some changes that improve things. I expect I'll move to a forwarding configuration just so I can let people consider a "win" and move on something else.