The solution in the future will be to re-introduce the default secure network and to only expose dns over the private IP