Complete procedures with a way back.

Publish a public zone from a recursion-disabled BIND 9 primary, transfer it only to approved secondaries, sign it with an explicit DNSSEC policy, submit the DS record to the parent, and prove delegation over UDP and TCP from outside the network.