2 ms·
Are you talking about the ability to NXDOMAIN *.example.com while also whitelisting this.example.com? AFAICT dnsmasq cant do this, I'm interested if bind can. I
by jakeogh 11y ago
Are you talking about the ability to NXDOMAIN *.example.com while also whitelisting this.example.com? AFAICT dnsmasq cant do this, I'm interested if bind can. I have a simple DNS request forwarder half-written to deal with rule trees.
Edit: https://github.com/paulchakravarti/dnslib https://github.com/paulchakravarti/dnslib looks interesting
- simoncion 11y ago> Are you talking about the ability to NXDOMAIN [star].example.com while also whitelisting this.example.com? Yeah, you can totally do that! Details are here [0][1], but in your RPZ zone file, you use a CNAME with a value of . to return NXDOMAIN, and a CNAME with a value of rpz-passthru. to process the query normally: ;allow www.sinfest.net, but deny all others, including sinfest.net www.sinfest.net CNAME rpz-passthru. sinfest.net CNAME . *.sinfest.net CNAME . And to demonstrate: $ dig +short www.sinfest.net ; dig +short sinfest.net; \ dig +short www.sinfest.net @8.8.8.8 ; dig +short sinfest.net @8.8.8.8 64.29.145.9 64.29.145.9 64.29.145.9 $ If you're interested in a complete, but simple RPZ zone file I can provide one. If you have more questions, feel free to ask, and I'll try to answer. [0] http://www.zytrax.com/books/dns/ch7/rpz.html http://www.zytrax.com/books/dns/ch7/rpz.html [1] http://www.zytrax.com/books/dns/ch7/rpz.html#rpz-examples http://www.zytrax.com/books/dns/ch7/rpz.html#rpz-examples
- jakeogh 11y agoFantastic. I'll add bind output and optional integration asap.