unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 8 Actions Packages Projects Releases Wiki Activity

bind-resolvers: forward to public resolvers, RBLs direct (#555)

Browse Source 
Recursing public names in-cluster SERVFAILs a few percent of cold lookups and loses the cache on every restart, which breaks CI. DNSBLs refuse or poison queries relayed via public resolvers, so rspamd's RBL lookups must keep resolving directly.

- add global forwarders 1.1.1.1 and 8.8.8.8 (forward first) to bind-resolvers
- add empty-forwarder zones to the openforwarder view for the RBL domains rspamd queries, so they resolve iteratively

Reviewed-on: #555
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #555.
This commit is contained in:
Unkin Agent
2026-10-16 23:29:33 +11:00
committed by BenVincent
parent 8ea58cb6c1
commit 2493e729f4
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/bind-internal/resolvers/cluster.yaml
+4 -1
View File
@@ -18,7 +18,10 @@ spec:
purelb.io/service-group: common
purelb.io/addresses: 198.18.200.7
external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
# No global forwarders: DNSBLs refuse queries relayed via public resolvers.
# Public names go via global forwarders; RBL zones bypass them (view.yaml).
forwarders:
- 1.1.1.1
- 8.8.8.8
# The internal split-horizon zones are served UNSIGNED by the in-cluster
# authoritative, but their public parents publish DS records (e.g. unkin.net
# is DNSSEC-signed on the Internet). With dnssec-validation on, the validator
apps/base/bind-internal/resolvers/view.yaml
+11
View File
@@ -23,3 +23,14 @@ spec:
- "allow-query-cache { any; }"
# pods have no IPv6 route; v6 NS attempts burn the recursion-query budget
- "server ::/0 { bogus yes; }"
# RBL zones resolve directly: DNSBLs refuse queries relayed via public resolvers.
- 'zone "spamhaus.org" { type forward; forwarders { }; }'
- 'zone "mailspike.net" { type forward; forwarders { }; }'
- 'zone "spameatingmonkey.net" { type forward; forwarders { }; }'
- 'zone "dnswl.org" { type forward; forwarders { }; }'
- 'zone "virusfree.cz" { type forward; forwarders { }; }'
- 'zone "blocklist.de" { type forward; forwarders { }; }'
- 'zone "msbl.org" { type forward; forwarders { }; }'
- 'zone "surbl.org" { type forward; forwarders { }; }'
- 'zone "uribl.com" { type forward; forwarders { }; }'
- 'zone "rspamd.com" { type forward; forwarders { }; }'