nameserver: allow recursion from everywhere (requires firewall)