I have a DNS resolver running BIND that serves clients in private address space (e.g., some of my clients are in 10.1.0.0/24), and separates them into Views.
There are domains on the public internet that have their NS servers resolving to private address space (e.g., example.com's NS is 10.2.0.1) which causes traffic from BIND to 10.2.0.1 in an attempt to resolve it.
How can I prevent BIND from trying to query authoritative nameservers in private address space when resolving? I still need to be able to respond to clients in private address space for other domains.