Windows DNS Server Remote Code Execution Vulnerability

If my server is not configured to be a DNS server, it is vulnerable?
No, this vulnerability is only exploitable if the server is configured to be a DNS server.

Can this vulnerability by mitigated by enabling Secure Zone Updates?
Enabling Secure Zone Updates constrains the potential sources of the attack, but does not completely prevent it. For example, a malicious insider could attack a “secure zone update” DNS server from a domain-joined computer. This is only a partial mitigation.
This vulnerability impacts any DNS server. The surrounding configuration can limit possible vectors/sources for the attack, but proper mitigation requires this month’s security update patch.

Security updates
10.0.19043.867 — https://support.microsoft.com/help/5000802
10.0.17763.1817 — https://support.microsoft.com/help/5000822
10.0.18363.1440 — https://support.microsoft.com/help/5000808
10.0.14393.4283 — https://support.microsoft.com/help/5000803
6.0.6003.21070 — https://support.microsoft.com/help/5000844
Security Only — https://support.microsoft.com/help/5000856
6.1.7601.24566 — https://support.microsoft.com/help/5000841
Security Only — https://support.microsoft.com/help/5000851
6.2.9200.23298 — https://support.microsoft.com/help/5000847
Security Only — https://support.microsoft.com/help/5000840
6.3.9600.19968 — https://support.microsoft.com/help/5000848
Security Only — https://support.microsoft.com/help/5000853