half broken

deploy/local.example.zone

@@ -1,24 +1,33 @@
 ; Local authoritative data. fancy-dns answers for these names itself, which
 ; removes the need for a second nameserver for a handful of records.
+;
+; Every name here is fully qualified on purpose. A master file is loaded with
+; an origin, and for a file under `blocklist.local_zones` that origin is the
+; file's base name (zonefile.OriginFromPath): `local.example.zone` gives the
+; origin "local.". A relative name would be qualified with THAT, so "ns1"
+; here would become ns1.local. and not ns1.lan. — a zone that looks right in
+; the editor and answers nothing. Absolute names are the same in every file,
+; whatever it is called.
 $TTL 300
-@ SOA ns1.lan. hostmaster.lan. 2024010101 3600 600 604800 300
-@ NS  ns1.lan.
-@ NS  ns2.lan.
+lan.        SOA     ns1.lan. hostmaster.lan. 2024010101 3600 600 604800 300
+lan.        NS      ns1.lan.
+lan.        NS      ns2.lan.
 
-ns1     A     192.168.1.2
-ns2     A     192.168.1.3
+ns1.lan.        A     192.168.1.2
+ns2.lan.        A     192.168.1.3
 
-router      A     192.168.1.1
-nas         A     192.168.1.10
-nas         AAAA  fd00::10
+router.lan.     A     192.168.1.1
+nas.lan.        A     192.168.1.10
+nas.lan.        AAAA  fd00::10
 
 ; A wildcard covers one label: printer.lan., host.lan., ...
-*.lan  A     192.168.1.50
+*.lan.          A     192.168.1.50
 
 ; A wildcard deeper down.
-*.internal.lan  A    10.0.0.50
+*.internal.lan. A     10.0.0.50
 
-; Services.
+; Services. These were already absolute; keeping every record absolute means
+; the file reads the same as it behaves.
 _ntp._udp.lan.        SRV 0 0 123 ns1.lan.
 _ldap._tcp.lan.       SRV 10 0 389 nas.lan.
 _dmarc._domain.lan.   TXT "v=DMARC1; p=reject; rua=mailto:dmarc.lan"