How can I protect an analog output from high voltage?
A 3v3 zener will have an awful slope resistance, i.e. it will load the DAC when the output is close to 3v3 but will not protect very effectively above 3v3.  I’d suggest using a series resistor (not ideal if you need a low output impedance but essential if you want to protect the DAC) and then diodes to clamp the DAC from being pulled far above the supply or below ground.  Typically ICs will tolerate about a diode drop beyond the supply rails.