HM> If you have a private namespace with its own (private) root,
HM> then the only (standard) way to check a second namespace like
HM> the Internet is through forwarding.

If one has one's own private root, then either one has grafted on some public
DNS database content at some point in the tree (using conditional forwarders,
"stub" "zones", or simply delegations) or one has not. In both cases there is
still one single namespace. In neither case does "checking a second
namespace" occur. And in neither case is forwarding a requirement.