> afaik your client can identify itself by TSIG instead of IP address. > of course, this requires tyour client to support TSIG ... Unfortunately the clients are dumb stub resolvers (Linux, Mac, Windows), so TSIG is not an option. -JP