unkinben
2706632f54
Resolver queries for unkin.net records returned SERVFAIL (broken trust chain): the in-cluster authoritative serves unkin.net UNSIGNED, but the public parent publishes a DS record (unkin.net is DNSSEC-signed on the Internet), so the validating resolver rejects the insecure answer. Add validate-except for the forwarded internal domains so the resolver treats them as insecure and does not validate them. unkin.net covers all *.unkin.net (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every NN.18.198.in-addr.arpa reverse zone; consul covers the consul TLD.