diff --git a/apps/base/bind-internal/resolvers/cluster.yaml b/apps/base/bind-internal/resolvers/cluster.yaml
index cfefc58..2fc2888 100644
--- a/apps/base/bind-internal/resolvers/cluster.yaml
+++ b/apps/base/bind-internal/resolvers/cluster.yaml
@@ -21,6 +21,15 @@ spec:
   forwarders:
     - 8.8.8.8
     - 1.1.1.1
+  # The internal split-horizon zones are served UNSIGNED by the in-cluster
+  # authoritative, but their public parents publish DS records (e.g. unkin.net
+  # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator
+  # sees "parent indicates secure" but gets an insecure answer and returns
+  # SERVFAIL (broken trust chain). Treat the forwarded internal domains as
+  # insecure so they are not validated. unkin.net covers all *.unkin.net
+  # (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone.
+  extraOptions:
+    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul }"
   resources:
     requests:
       cpu: 20m