Hi ard On Fri, Jan 27, 2017 at 08:51:14PM +0000, der...@mskcc.org wrote: > Hi All, > > Back in December 2016, I worked on a problem in which a particular hostname > (a website) would not resolve from our DNS servers, but Level3, Google DNS, > and OpenDNS resolved it. It was clear that somewhere outside our network > there was policy (security or otherwise) that prevented us from getting the > resolution. It was not easy to get the website owners to work on this from > their side, but eventually the problem was corrected. How this case is > relevant to bind-users is that we implement RPZs and I had hoped that I could > add the hostname to the RPZ zone and return to clients the IP that I knew was > correct (from Level3, OpenDNS). However, I was told by our vendor that that > was no possible because RPZs only trigger when there is an actual resolution > for the queried A record. > > Doing some reading today, I came across Paul Vixie's (creator of DNS RPZ) > article "What are the features of the DNS RPZ firewall?" on the ISC.org site > (https://deepthought.isc.org/article/AA-00516/0). There he lists the > triggers that a DNS RPZ honors. Here is the section: > > In a DNS firewall based on DNS RPZ, each rule can use one of four policy > triggers and specify one of four policy actions. > > A response policy in DNS RPZ can be triggered as follows: > > 1. by the query name. > 2. by an address which would be present in a truthful response. > 3. by the name or address of an authoritative name server > responsible for publishing the original response. > > So, there it is: trigger 1 is what I was looking for. > > Our DNS platform is BIND based, and I don't understand why the vendor's > implementation (mostly ISC code from my understanding) does not comport > itself according to Paul Vixie's specs above. Instead it has added a > dependency in which the server must receive a response in order for a > response policy action to be triggered.
It is not clear which "vendor's implementation" you're talking about,
but in this case you ought to contact the vendor if it is not ISC, and
not this list. This list is about vanilla BIND.
In vanilla BIND, see the "qname-wait-recurse" option.
Mukund
signature.asc
Description: PGP signature
_______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
