https://www.sans.org/reading-room/whitepapers/analyst/securing-dns-emerging-threats-hybrid-approach-37692