Two major problems need to be solved for bring your own bind:

1. Designate's miniDNS must be accessible to a customers provided DNS servers through a fixed set of externally accessible IPs.
2. Communication from the designate worker must appear with a known source IP or list of known source IPs so the customer can use ACLs to protect their DNS system.