Thanks lhoward, that's it to a tee. Alternate namesevers (same as resolv.conf) occured to me as soon as I posted the question. Wasn't as close as I thought.

I've got MX record and authoritative nameserver query working. With a bit more tweaking (timestamp, reverse lookup, taint+strict cleanup), I'll be ready to post this marginally useful script on Code or Craft.