If you run powerdns auth, consider front-running it with dnsdist (also from powerdns).

(disclaimer: I contribute a tiny bit to dnsdist.)