$ORIGIN example.net.
$TTL 300

@ IN SOA ns1.example.net. admin.example.net. (
    2024020108 300 60 604800 300
)

; Public DNS — RFC 1918 addresses NEVER appear here. The whole point of
; the e2e simulation is to model real internet connectivity, where
; private IPs are unreachable from outside. All public-facing names
; resolve to the firewall's external IP (203.0.113.100), which DNATs
; inbound to the right internal host.
@       IN NS   ns1.example.net.
ns1     IN A    100.64.0.55
@       IN A    203.0.113.100
www     IN A    203.0.113.100