1. Set it as default.
2. Document the setting and how to change it via local files.

How to test:
1. install IPA with --setup-dns and defined --forwarder
2. query record not-managed by installed IPA (e.g. www.freeipa.org) from localhost - should pass both with and without the patch
3. query record not-managed by installed IPA from other computer from different subnet - fails without the patch and should pass with the patch

Suggested documentation change:

I suggest adding the following doc to the end of chapter "5.6.
DNS" (after the paragraphs about forwarders):

Any host is permitted to issue recursive queries against configured
forwarders by default. When required, this behavior can be changed
in /etc/named.conf in "allow-recursion" statement. Please consult name
server documentation for details how to edit the configuration
statement.

master: 5f4c75e

ipa-2-0: 99669f5