"Hidden Master" visible slave

[carcarx at hotmail.com]

No, it's not a big-budget Chinese kung-fu movie. ;-)

We want to set up a DNS server for departmental administrators to
maintain
their own zones, but not "mess" with our primary nameservers.

Our idea is to have that "departmental" nameserver master some zones
with our primary nameservers being the slaves for those zones, but
we don't want the departmental server to be visible to the internet.

Since the authoritative server for those zones won't be visible the
clients should look to the visible ones (with some delay).

Any docs about how to automatically avoid referrals to the departmental
server (aside from tcp/ip rerouting trickery).

Thank you!