I would like to find out if it's possible to restrict insecure updates to a single IP. I have a firewall with a DHCP, which is capable of sending DNS updates, even signing them with TSIG, but only HMAC/MD5. So for that scenario I'm only left with insecure updates for a zone, but I don't want to open it up for anyone, just for my Firewall.
While zone transfers can be limitide to IPs and there is Add-DnsServerQueryResolutionPolicy, I couldn't find a way to establish a policy limiting the access for updates to a single IP.