The designate services communicate with the bind9 instances two ways: rndc calls from the producer and zone transfers with the miniDNS server. Should we simply use the designate network attachment for this for the managed bind configuration? This would  make the miniDNS only listen on that network, securing it from outside access. We can also configure the DNS servers ACLs to allow access by CIDR instead of individual IPs for this kind of access.