diff --git a/apps/base/bind-internal/resolvers/cluster.yaml b/apps/base/bind-internal/resolvers/cluster.yaml
index bda2308..ea14e19 100644
--- a/apps/base/bind-internal/resolvers/cluster.yaml
+++ b/apps/base/bind-internal/resolvers/cluster.yaml
@@ -18,9 +18,7 @@ spec:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.7
       external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
-  forwarders:
-    - 8.8.8.8
-    - 1.1.1.1
+  # No global forwarders: DNSBLs refuse queries relayed via public resolvers.
   # The internal split-horizon zones are served UNSIGNED by the in-cluster
   # authoritative, but their public parents publish DS records (e.g. unkin.net
   # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator