See https://deepthought.isc.org/article/AA-00538/0/How-can-I-disable-global-forwarding-for-delegated-subdomains.html

diff --git a/services/univention-bind/bind.py b/services/univention-bind/bind.py
index 9e1415f7e9..282652df5c 100755
--- a/services/univention-bind/bind.py
+++ b/services/univention-bind/bind.py
@@ -155,6 +155,7 @@ def _new_zone(ucr, zonename, dn):
 	proxy_zone.write('\ttype slave;\n')
 	proxy_zone.write('\tfile "%s.zone";\n' % (zonename,))
 	proxy_zone.write('\tmasters port 7777 { 127.0.0.1; };\n')
+	proxy_zone.write('\tforwarders {};\n')
 	proxy_zone.write('};\n')
 	proxy_zone.close()
 	os.chmod(proxy_file, 0o640)