Does CF DNS not use qname minimization? That would reduce the association between subnets and names looked up.