If you are worried about DNS resolving failures, you can run bind as a local resolver and only have it listen on 127.0.0.1 or only allow certain hosts to query it, including the local machine it runs on.
Puppet or Cfengine to actually run the updates on the machines. Then you can run a vulnerability checker, such as nessus, to verify that the updates are installed.
If you are worried about DNS resolving failures, you can run bind as a local resolver and only have it listen on 127.0.0.1 or only allow certain hosts to query it, including the local machine it runs on.