We dont run rpz on the resolver nodes, hopefully when we clear the backlog of things we want to fix/tweak/finish we can get around to dropping some docs on the cool stuff we built/did, and why. #todolist
I look forward to reading that as a fellow DNS Engineer that works at large scale and has a passion for security.