From 86cd3f03e5b01707c1a25325e358a16091e95c04 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 24 Oct 2026 16:31:16 +1100
Subject: [PATCH] bind-resolvers: declare RBL zones as BindZones

---
 .../resolvers/kustomization.yaml              |   1 +
 .../bind-internal/resolvers/rbl-zones.yaml    | 121 ++++++++++++++++++
 apps/base/bind-internal/resolvers/view.yaml   |  11 --
 3 files changed, 122 insertions(+), 11 deletions(-)
 create mode 100644 apps/base/bind-internal/resolvers/rbl-zones.yaml

diff --git a/apps/base/bind-internal/resolvers/kustomization.yaml b/apps/base/bind-internal/resolvers/kustomization.yaml
index 51fc92e..5e8e16f 100644
--- a/apps/base/bind-internal/resolvers/kustomization.yaml
+++ b/apps/base/bind-internal/resolvers/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - acls.yaml
   - view.yaml
   - forward-zones.yaml
+  - rbl-zones.yaml
diff --git a/apps/base/bind-internal/resolvers/rbl-zones.yaml b/apps/base/bind-internal/resolvers/rbl-zones.yaml
new file mode 100644
index 0000000..b2d9a20
--- /dev/null
+++ b/apps/base/bind-internal/resolvers/rbl-zones.yaml
@@ -0,0 +1,121 @@
+# DNSBLs refuse queries relayed via public resolvers, so these zones resolve directly.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-spamhaus-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: spamhaus.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-mailspike-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: mailspike.net
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-spameatingmonkey-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: spameatingmonkey.net
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-dnswl-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: dnswl.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-virusfree-cz
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: virusfree.cz
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-blocklist-de
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: blocklist.de
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-msbl-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: msbl.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-surbl-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: surbl.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-uribl-com
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: uribl.com
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-rspamd-com
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: rspamd.com
+  type: forward
+  catalog: false
diff --git a/apps/base/bind-internal/resolvers/view.yaml b/apps/base/bind-internal/resolvers/view.yaml
index 3587fe9..ce33d33 100644
--- a/apps/base/bind-internal/resolvers/view.yaml
+++ b/apps/base/bind-internal/resolvers/view.yaml
@@ -23,14 +23,3 @@ spec:
     - "allow-query-cache { any; }"
     # pods have no IPv6 route; v6 NS attempts burn the recursion-query budget
     - "server ::/0 { bogus yes; }"
-    # RBL zones resolve directly: DNSBLs refuse queries relayed via public resolvers.
-    - 'zone "spamhaus.org" { type forward; forwarders { }; }'
-    - 'zone "mailspike.net" { type forward; forwarders { }; }'
-    - 'zone "spameatingmonkey.net" { type forward; forwarders { }; }'
-    - 'zone "dnswl.org" { type forward; forwarders { }; }'
-    - 'zone "virusfree.cz" { type forward; forwarders { }; }'
-    - 'zone "blocklist.de" { type forward; forwarders { }; }'
-    - 'zone "msbl.org" { type forward; forwarders { }; }'
-    - 'zone "surbl.org" { type forward; forwarders { }; }'
-    - 'zone "uribl.com" { type forward; forwarders { }; }'
-    - 'zone "rspamd.com" { type forward; forwarders { }; }'
-- 
2.47.3