The KASP enforcer should be able to enforce a policy the root zone. The zone name is likely to be set to "." or possibly "".