I have a user who's machine is not pingable on our network, using computer hostname or associated IP. However, in troubleshooting this, I see that the IP the machine actually has does not resolve to ...

The filtering worked, the encrypted DNS worked, and then I had to stop everyone else from using it.

If your internal domain ends in .local, it's probably conflicting with Bonjour, which also uses .local. I remember a thread from PeterB a little while ago complaining about this.

It's an upgrade worth making, but it comes down to your privacy concerns.