From 716ff7c807f341cf0ba92788316bce9fb2bebc18 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 13 Oct 2026 20:53:37 +1100 Subject: [PATCH] Recurse from root hints on bind-resolvers (#546) DNSBLs such as Spamhaus refuse queries that arrive via public resolvers, and forwarding everything to 8.8.8.8/1.1.1.1 leaves the estate dependent on them. The lab resolvers now do full recursion themselves (DNSSEC-validated via the operator default `dnssec-validation auto` and BIND built-in root hints). - drop the global forwarders from the bind-resolvers BindCluster - keep the per-zone forwarders for unkin.net, consul, k8s and reverse zones unchanged Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/546 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/bind-internal/resolvers/cluster.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/apps/base/bind-internal/resolvers/cluster.yaml b/apps/base/bind-internal/resolvers/cluster.yaml index bda2308..ea14e19 100644 --- a/apps/base/bind-internal/resolvers/cluster.yaml +++ b/apps/base/bind-internal/resolvers/cluster.yaml @@ -18,9 +18,7 @@ spec: purelb.io/service-group: common purelb.io/addresses: 198.18.200.7 external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net - forwarders: - - 8.8.8.8 - - 1.1.1.1 + # No global forwarders: DNSBLs refuse queries relayed via public resolvers. # The internal split-horizon zones are served UNSIGNED by the in-cluster # authoritative, but their public parents publish DS records (e.g. unkin.net # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator