unkin-agent 716ff7c807 Recurse from root hints on bind-resolvers (#546) ...

DNSBLs such as Spamhaus refuse queries that arrive via public resolvers, and forwarding everything to 8.8.8.8/1.1.1.1 leaves the estate dependent on them. The lab resolvers now do full recursion themselves (DNSSEC-validated via the operator default `dnssec-validation auto` and BIND built-in root hints).

- drop the global forwarders from the bind-resolvers BindCluster
- keep the per-zone forwarders for unkin.net, consul, k8s and reverse zones unchanged

Reviewed-on: #546
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-10-13 20:53:37 +11:00

..

base

Recurse from root hints on bind-resolvers (#546)

2026-10-13 20:53:37 +11:00

overlays/au-syd1

Add mail namespace with Stalwart backing stores (#538)

2026-10-12 00:25:41 +11:00