I raised a review to include the CIDR for the dns-backend binding but that's not actually correct - allowed nets needs to include the IP addresses of the designate servers - there is no guarantee that they will be in the same CIDR as the local unit binding to whatever space is configured.
I raised a review to include the CIDR for the dns-backend binding but that's not actually correct - allowed nets needs to include the IP addresses of the designate servers - there is no guarantee that they will be in the same CIDR as the local unit binding to whatever space is configured.