PowerDNS IP Update

The REFUSED test at the end is worth actually running before publishing, since it is the clearest confirmation that the access control is doing what you think it is. An unsigned update that silently succeeds means the zone metadata was not applied correctly.

The note about orphaned record cleanup at the end is intentionally left open. If that becomes a follow-on article in the series, the groundwork is laid. Ready for the next one.