[andyjpb]

There is still Hesiod support in GlibC / NSS, etc on most modern systems. When put together with Kerberos it's a nice way to provision auth on lots of machines automatically.

It's nice to have a dedicated and restricted resolver config so that the zone visibility can be restricted but that makes deployment a little more complex.