[RPZ] Fwd: strange result with rpz
vjs at rhyolite.com
Wed Sep 21 17:15:06 UTC 2011
> From: <iharrathi.ext at orange.com>
> To: Raymond Dijkxhoorn <raymond at prolocation.net>,
> Vernon Schryver <vjs at rhyolite.com>
> CC: "dnsrpz-interest at lists.isc.org" <dnsrpz-interest at lists.isc.org>
> Hi you're missing the point :)
> Yes what i want is that everything in *.fr have like answer
> 127.0.0.17 except a.b.c.myzone.fr this is why i write:
> a.b.c.myzone.fr IN CNAME a.b.c.myzone.fr.
> *.fr IN A 127.0.0.17
> My problem is that with this configuration i have also real answer
> for www.myzone.fr, ftp.myzone.fr, x.y.z.myzone.fr instead of the
> 127.0.0.17 desired.
> Hope i was clear.
The results you are seeing come from the way DNS wildcards work.
See for example this parahgraph in
To quote RFC 1912, "A common mistake is thinking that a wildcard
MX for a zone will apply to all hosts in the zone. A wildcard
MX will apply only to names in the zone which aren't listed in
the DNS at all." That is, if there is a wild card MX for
*.example.com, and an A record (but no MX record) for
www.example.com, the correct response (as per RFC 1034) to an
MX request for www.example.com is "no error, but no data"; the
expected response is the MX record attached to *.example.com.
In other words, the existence of the a.b.c.myzone.fr RPZ record
requires that the *.fr wildcard not match any sub-domain of myzone.fr.
To get what I understand to be the desired (albeit surprising)
a.b.c.myzone.fr CNAME a.b.c.myzone.fr.
*.a.b.c.myzone.fr A 127.0.0.17
*.b.c.myzone.fr A 127.0.0.17
*.c.myzone.fr A 127.0.0.17
*.fr A 127.0.0.17
Vernon Schryver vjs at rhyolite.com
More information about the DNSfirewalls