Only doing resolution for your own domain and dnssec solve pretty much all those issues and is pretty darn easy.

And I did say that the web gui is what you need to lock down, DNS has no vulnerabilities exploitable through port 53 that lets an attacker take control of the server.