DNS Control Policy

Looking for an official best practices document for implementing DNS Control policies to enhance security posture.

Essential rules to start off with little to no impact.