I have a separate lan for untrusted devices, I only use whitelisting. No public DNS for these devices.