On Sun, 4 Sep 2016 12:49:47 +0200 Axb wrote: > And often forgotten: > dns_query_restriction deny > > for example: > dns_query_restriction deny sorbs.net
I've not tried it, but it's based on the best match, so you could presumably make it deny by default like this: dns_query_restriction allow sorbs.net dns_query_restriction deny com net org
