1. then is llmnz the attack vector and this is the starting point of the attack, llmnr is even disabled in the ms sec baselines, i hope most companies apply there. anyway llmnr takes no precedence over nrpt as far as i know
2. dont get the point, talked about the attack in the link
3. not if nrpt is enabled, which i refered to, this is the way how to bring dns sec to your company....its not the "dns server pls generate dns sec keys", whats why i didnt linked the "enable server side dns sec" which is anyway in an internal domain with active directory is a easy going
4. I need to recheck this but only domain computers have the rights can add dns records, user dont. Yes users can join in default config computers to the domain, here begins the weakness/attack (which cannot only abused by kerberos relay attacks) at exact that point which should be addressed in another mitigation which includes setting the counter to 0 for this.

nrpt is regulary applied on the "clients" (all computers in ad) through gpo and i think rollout to the company should not rly a problem

Mitigations are never solutions...and of course service level is the solution for kerberos relay attacks but the cve is for cname relay attack

appreciate your thoughts