suggested configuration results in open DNS resolver

[soletan]

The configuration suggested for this plugin is turning a CoreDNS sservice into an open DNS resolver when using CoreDNS as a regular DNS server (not hidden in a k8s cluster). Having a warning as a minimum precaution on using that configuration would be helpful. Having a more specific configuration example limiting use of forward plugin to a certain domain would be even better, though I'm not 100% sure how secure this would be eventually.

[endreszabo]

We need clarification on why an authoritative DNS server would need to look up external CNAME records. Using the plugin/lookup to run another round of internal DNS lookup is completely fine, but letting it query an external forwarder is suboptimal, at minimum.