255 days late but anyway
Okay but what's the actual false positive rate on that. No way you're checking 600 rules for overlap or ordering bugs. I had maybe 40 on a RackNerd setup once and still found mails vanishing into the void because two rules contradicted.
Also OP if you're still around, did you ever solve this. The "clients who barely know what DNS is" part is the real killer, anything without a panel they'll call you for every password reset.