From 989340efefc023d931ce357a73ca60af58101795 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 16 Oct 2026 23:24:27 +1100 Subject: [PATCH] bind-resolvers: forward public names to 1.1.1.1/8.8.8.8, resolve RBL zones directly --- apps/base/bind-internal/resolvers/cluster.yaml | 5 ++++- apps/base/bind-internal/resolvers/view.yaml | 11 +++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/apps/base/bind-internal/resolvers/cluster.yaml b/apps/base/bind-internal/resolvers/cluster.yaml index ea14e19..ff821c0 100644 --- a/apps/base/bind-internal/resolvers/cluster.yaml +++ b/apps/base/bind-internal/resolvers/cluster.yaml @@ -18,7 +18,10 @@ spec: purelb.io/service-group: common purelb.io/addresses: 198.18.200.7 external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net - # No global forwarders: DNSBLs refuse queries relayed via public resolvers. + # Public names go via global forwarders; RBL zones bypass them (view.yaml). + forwarders: + - 1.1.1.1 + - 8.8.8.8 # The internal split-horizon zones are served UNSIGNED by the in-cluster # authoritative, but their public parents publish DS records (e.g. unkin.net # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator diff --git a/apps/base/bind-internal/resolvers/view.yaml b/apps/base/bind-internal/resolvers/view.yaml index ce33d33..3587fe9 100644 --- a/apps/base/bind-internal/resolvers/view.yaml +++ b/apps/base/bind-internal/resolvers/view.yaml @@ -23,3 +23,14 @@ spec: - "allow-query-cache { any; }" # pods have no IPv6 route; v6 NS attempts burn the recursion-query budget - "server ::/0 { bogus yes; }" + # RBL zones resolve directly: DNSBLs refuse queries relayed via public resolvers. + - 'zone "spamhaus.org" { type forward; forwarders { }; }' + - 'zone "mailspike.net" { type forward; forwarders { }; }' + - 'zone "spameatingmonkey.net" { type forward; forwarders { }; }' + - 'zone "dnswl.org" { type forward; forwarders { }; }' + - 'zone "virusfree.cz" { type forward; forwarders { }; }' + - 'zone "blocklist.de" { type forward; forwarders { }; }' + - 'zone "msbl.org" { type forward; forwarders { }; }' + - 'zone "surbl.org" { type forward; forwarders { }; }' + - 'zone "uribl.com" { type forward; forwarders { }; }' + - 'zone "rspamd.com" { type forward; forwarders { }; }'