From db11f6a246ebc7db99102b23f6fd260e638f7640 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 13 Oct 2026 20:38:21 +1100 Subject: [PATCH] Recurse from root hints on bind-resolvers instead of forwarding to public resolvers --- apps/base/bind-internal/resolvers/cluster.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/apps/base/bind-internal/resolvers/cluster.yaml b/apps/base/bind-internal/resolvers/cluster.yaml index bda2308..ea14e19 100644 --- a/apps/base/bind-internal/resolvers/cluster.yaml +++ b/apps/base/bind-internal/resolvers/cluster.yaml @@ -18,9 +18,7 @@ spec: purelb.io/service-group: common purelb.io/addresses: 198.18.200.7 external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net - forwarders: - - 8.8.8.8 - - 1.1.1.1 + # No global forwarders: DNSBLs refuse queries relayed via public resolvers. # The internal split-horizon zones are served UNSIGNED by the in-cluster # authoritative, but their public parents publish DS records (e.g. unkin.net # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator