Yes, some can. Unbound's "private-address" and "private-domain" directives control this. Similarly, bind9 has "deny-answer-addresses" (with an "except-from" o

Yes, some can. Unbound's "private-address" and "private-domain" directives control this. Similarly, bind9 has "deny-answer-addresses" (with an "except-from" option so you can specify local domains that are allowed to use them): https://bind9.readthedocs.io/en/v9.18.20/reference.html#content-filtering https://bind9.readthedocs.io/en/v9.18.20/reference.html#cont... Not sure about others.