I find it to not be of concern. I would never have it happen, because it's a bizarre and problematic way to handle internal DNS. But anyone who can exploit private IP mapping can figure it out without DNS in the first place. So I see no reason to want to hide it.

I haven’t tried it but process substitution may work if you enable envsubst.

So rather than an include you might just be able to do:

$( nslookup domain.com | yada yada)

Driving so don’t feel like typing out anything.

I'd still use DuckDNS.org
0_1492522125211_duckdns.png