apps/base/bind-internal/resolvers/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - acls.yaml
   - view.yaml
   - forward-zones.yaml
+  - rbl-zones.yaml

apps/base/bind-internal/resolvers/rbl-zones.yaml

@@ -0,0 +1,121 @@
+# DNSBLs refuse queries relayed via public resolvers, so these zones resolve directly.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-spamhaus-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: spamhaus.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-mailspike-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: mailspike.net
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-spameatingmonkey-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: spameatingmonkey.net
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-dnswl-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: dnswl.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-virusfree-cz
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: virusfree.cz
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-blocklist-de
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: blocklist.de
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-msbl-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: msbl.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-surbl-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: surbl.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-uribl-com
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: uribl.com
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-rspamd-com
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: rspamd.com
+  type: forward
+  catalog: false

apps/base/bind-internal/resolvers/view.yaml

@@ -23,14 +23,3 @@ spec:
     - "allow-query-cache { any; }"
     # pods have no IPv6 route; v6 NS attempts burn the recursion-query budget
     - "server ::/0 { bogus yes; }"
-    # RBL zones resolve directly: DNSBLs refuse queries relayed via public resolvers.
-    - 'zone "spamhaus.org" { type forward; forwarders { }; }'
-    - 'zone "mailspike.net" { type forward; forwarders { }; }'
-    - 'zone "spameatingmonkey.net" { type forward; forwarders { }; }'
-    - 'zone "dnswl.org" { type forward; forwarders { }; }'
-    - 'zone "virusfree.cz" { type forward; forwarders { }; }'
-    - 'zone "blocklist.de" { type forward; forwarders { }; }'
-    - 'zone "msbl.org" { type forward; forwarders { }; }'
-    - 'zone "surbl.org" { type forward; forwarders { }; }'
-    - 'zone "uribl.com" { type forward; forwarders { }; }'
-    - 'zone "rspamd.com" { type forward; forwarders { }; }'