Might be an idea to not use any public A records and just use it for cert issuance, and Stick with private resolvers for private use.

Nobody should be using SCP, use rsync.