Just curious, but I assume that a Split-DNS setup would still be required with the ZCA if it is run behind a firewall.

How would this be done with the appliance? Is it ok to access the OS to install bind and make the necessary configuration as you would do with the open source edition?

Also, are the changes made persistent across updates and is anything broken by accessing the OS?