The bind-resolvers forwarded k8s.syd1.au.unkin.net to the in-cluster
bind-externaldns (198.18.200.8), which is not reliably serving those
records yet, so lookups return NXDOMAIN. Notably Gitea cannot resolve the
k8s CI host, so its webhook fails and tagged releases (e.g. bind-operator)
never trigger CI.
Point the forwarder at the existing external external-dns bind service
anycast (198.18.19.20, puppet roles::infra::dns::externaldns), which still
holds the working records. Temporary; revert to 198.18.200.8 once
external-dns publishes to the in-cluster service.
unkinben