bind-resolvers: forward public names to 1.1.1.1/8.8.8.8, resolve RBL zones directly

apps/base/bind-internal/resolvers/cluster.yaml

@@ -18,7 +18,10 @@ spec:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.7
       external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
-  # No global forwarders: DNSBLs refuse queries relayed via public resolvers.
+  # Public names go via global forwarders; RBL zones bypass them (view.yaml).
+  forwarders:
+    - 1.1.1.1
+    - 8.8.8.8
   # The internal split-horizon zones are served UNSIGNED by the in-cluster
   # authoritative, but their public parents publish DS records (e.g. unkin.net
   # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator

apps/base/bind-internal/resolvers/view.yaml

@@ -23,3 +23,14 @@ spec:
     - "allow-query-cache { any; }"
     # pods have no IPv6 route; v6 NS attempts burn the recursion-query budget
     - "server ::/0 { bogus yes; }"
+    # RBL zones resolve directly: DNSBLs refuse queries relayed via public resolvers.
+    - 'zone "spamhaus.org" { type forward; forwarders { }; }'
+    - 'zone "mailspike.net" { type forward; forwarders { }; }'
+    - 'zone "spameatingmonkey.net" { type forward; forwarders { }; }'
+    - 'zone "dnswl.org" { type forward; forwarders { }; }'
+    - 'zone "virusfree.cz" { type forward; forwarders { }; }'
+    - 'zone "blocklist.de" { type forward; forwarders { }; }'
+    - 'zone "msbl.org" { type forward; forwarders { }; }'
+    - 'zone "surbl.org" { type forward; forwarders { }; }'
+    - 'zone "uribl.com" { type forward; forwarders { }; }'
+    - 'zone "rspamd.com" { type forward; forwarders { }; }'