....That said, you have to make sure you're excluding from apt-get all systems that DA expects to change itself. For example you should not update (or even have on your server) either the package that adds chrooted bind, or the one that adds the cacheing nameserver.
Jeff