This is the only way of getting it to work, it seems. BIND9 can be
persuaded to serve using a nonstandard port, but it has no way to
forward to another server listening on such a port. This is obviously
crazy, but I'm still running a surplus of addresses.