dns 1-off

[Gordon Bowersox]

I am using DNS to block access to certain external websites.  Our 
firewall does not block entire domains well.

But I have need to allow certain people to correctly resolve some of the 
external sites.   I am looking at views to control this, but wonder if I 
can use acl to block some people from seeing some of my fake zones? Or 
perhaps allow some people to forward request on a per zone basis?