How do you currently deal with pinned certificates on those devices? What makes you think that they're currently respecting your network? A Google Chromecast will already ignore all of your network-wide DNS settings.

This removes a couple of avenues of attack you might have used to rein in some of those devices (but probably weren't doing), but it's just a symptom of the fact that using DNS for device control was always a really hacky, kind of awful solution to the problem of having rogue devices on the network.