Another option is to stand up a DNS server that knows how to do something like BIND 9's Response Policy Zone [0][1]. Although figuring out how to propagate RPZ

Another option is to stand up a DNS server that knows how to do something like BIND 9's Response Policy Zone [0][1]. Although figuring out how to propagate RPZ changes to them isn't exactly straightforward (more on this below), if you're using BIND, you can set up views that match certain clients and provide one mix of RPZs to one set, and another to another set. On updating RPZs in a view (warning: BIND 9-specific instructions follow) : So, BIND has this nifty option for a zone called "in-view". This lets you say "The data for this particular zone lives in this other view, so when requests come in for this zone, in this view, use the data in this other view.". It might sound complicated, but it's really just a pointer to a pre-existing zone definition. This lets you define your master zones in one big "zone definition" view, and have client-specific views refer back to those definitions. However, you can't use in-view with RPZs. Why? Who knows? [2] But, what you can do is this: * Create one unique RNDC key per view * Add an allow-notify and match-clients entry in each view with that view's key * In the appropriate views, add a slave zone definition for each relevant RPZ, with localhost as the master, and whatever is your usual domain xfer key as the key [3] * Back up in your "zone definition" view, add to your also-notify list for each master RPZ definition an entry for localhost and each view key. [4] Having an ACL just for these RPZ slaves cleans up the RPZ definitions. Now you have dynamically updatable host blocking that can be deployed on a per-host basis, if you like. It's initially a bit more work than managing a local hosts file, but you can easily apply host blocking lists to any set of machines on your LAN, and you can programmatically update the RPZ lists with tools like nsupdate. [0] http://jpmens.net/2011/04/26/how-to-configure-your-bind-resolvers-to-lie-using-response-policy-zones-rpz/ http://jpmens.net/2011/04/26/how-to-configure-your-bind-reso... [1] http://www.zytrax.com/books/dns/ch7/rpz.html http://www.zytrax.com/books/dns/ch7/rpz.html [2] RPZs are handled just like regular zones in every other way except for this one. It's a bit frustrating. [3] This is actually less burdensome than it sounds, as you can write these slave zone definitions once and include the files containing the definitions in whatever view needs them. [4] That is, if you had three views, your also-notify list would have something like the following new entries: 127.0.0.1 key "view1-key"; 127.0.0.1 key "view2-key"; 127.0.0.1 key "view3-key"; You can have entries for just the views that use a given RPZ, but it doesn't hurt to have one ACL that notifies all views when any RPZ data changes.