Recurse from root hints on bind-resolvers instead of forwarding to public resolvers

2026-10-13 20:38:21 +11:00
parent 0ee11a065b
commit db11f6a246
1 changed files with 1 additions and 3 deletions
@@ -18,9 +18,7 @@ spec:
      purelb.io/service-group: common
      purelb.io/addresses: 198.18.200.7
      external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
-  forwarders:
-    - 8.8.8.8
-    - 1.1.1.1
+  # No global forwarders: DNSBLs refuse queries relayed via public resolvers.
  # The internal split-horizon zones are served UNSIGNED by the in-cluster
  # authoritative, but their public parents publish DS records (e.g. unkin.net
  # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator