From 2493e729f468c4ec445767d2acce495173f1a8ce Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 16 Oct 2026 23:29:33 +1100 Subject: [PATCH] bind-resolvers: forward to public resolvers, RBLs direct (#555) Recursing public names in-cluster SERVFAILs a few percent of cold lookups and loses the cache on every restart, which breaks CI. DNSBLs refuse or poison queries relayed via public resolvers, so rspamd's RBL lookups must keep resolving directly. - add global forwarders 1.1.1.1 and 8.8.8.8 (forward first) to bind-resolvers - add empty-forwarder zones to the openforwarder view for the RBL domains rspamd queries, so they resolve iteratively Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/555 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/bind-internal/resolvers/cluster.yaml | 5 ++++- apps/base/bind-internal/resolvers/view.yaml | 11 +++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/apps/base/bind-internal/resolvers/cluster.yaml b/apps/base/bind-internal/resolvers/cluster.yaml index ea14e19..ff821c0 100644 --- a/apps/base/bind-internal/resolvers/cluster.yaml +++ b/apps/base/bind-internal/resolvers/cluster.yaml @@ -18,7 +18,10 @@ spec: purelb.io/service-group: common purelb.io/addresses: 198.18.200.7 external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net - # No global forwarders: DNSBLs refuse queries relayed via public resolvers. + # Public names go via global forwarders; RBL zones bypass them (view.yaml). + forwarders: + - 1.1.1.1 + - 8.8.8.8 # The internal split-horizon zones are served UNSIGNED by the in-cluster # authoritative, but their public parents publish DS records (e.g. unkin.net # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator diff --git a/apps/base/bind-internal/resolvers/view.yaml b/apps/base/bind-internal/resolvers/view.yaml index ce33d33..3587fe9 100644 --- a/apps/base/bind-internal/resolvers/view.yaml +++ b/apps/base/bind-internal/resolvers/view.yaml @@ -23,3 +23,14 @@ spec: - "allow-query-cache { any; }" # pods have no IPv6 route; v6 NS attempts burn the recursion-query budget - "server ::/0 { bogus yes; }" + # RBL zones resolve directly: DNSBLs refuse queries relayed via public resolvers. + - 'zone "spamhaus.org" { type forward; forwarders { }; }' + - 'zone "mailspike.net" { type forward; forwarders { }; }' + - 'zone "spameatingmonkey.net" { type forward; forwarders { }; }' + - 'zone "dnswl.org" { type forward; forwarders { }; }' + - 'zone "virusfree.cz" { type forward; forwarders { }; }' + - 'zone "blocklist.de" { type forward; forwarders { }; }' + - 'zone "msbl.org" { type forward; forwarders { }; }' + - 'zone "surbl.org" { type forward; forwarders { }; }' + - 'zone "uribl.com" { type forward; forwarders { }; }' + - 'zone "rspamd.com" { type forward; forwarders { }; }'