My guess would be with DNS set to non-secure it never stamped the records with the correct ACL's and now that we've switched all these existing systems can't update their DNS records (or DHCP can ...

is there no way to use DNS name in a ACL? Or will it periodically update (seems unlikely)? It seems like it's just translating name to IP the first time I put the ACL in. How will it update to the ...