> 53 is required because instance runs its own authoritative DNS server.

Are you planning to offer alternative solutions for this, e.g. pointing a wildcard A record at the server running the instance? I'd rather not run a publicly accessible DNS server.