Do You Need a Recursive Resolver?

You want two completely separate servers and you're configuring them as the primary and secondary resolver. Even if you're getting 10,000 DNS queries a second, one server probably can handle that. You have to figure out how you want to authenticate the users that are going to make DNS queries from your servers. And I'm guessing the best way to do that is going to be some kind of VPN. It might be easier and make more sense to run multiple bind instances rather than trying to deal with a single bind instance with like a million different views.