Lesson for implementers: block all DNS requests from customers unless they are addressed to a onboard DNS cache (whose IP address is supplied by the DHCP response).