[RPZ] Fwd: strange result with rpz

Vernon Schryver vjs at rhyolite.com
Wed Sep 21 17:15:06 UTC 2011

> From: <iharrathi.ext at orange.com>
> To: Raymond Dijkxhoorn <raymond at prolocation.net>,
>         Vernon Schryver <vjs at rhyolite.com>
> CC: "dnsrpz-interest at lists.isc.org" <dnsrpz-interest at lists.isc.org>

> Hi you're missing the point :)
> Yes what i want is that everything in *.fr have like answer
> except a.b.c.myzone.fr this is why i write:
>  		a.b.c.myzone.fr IN CNAME a.b.c.myzone.fr.
> 		*.fr           IN      A
> My problem is that with this configuration i have also real answer
> for www.myzone.fr, ftp.myzone.fr, x.y.z.myzone.fr instead of the
> desired.
> Hope i was clear.

The results you are seeing come from the way DNS wildcards work.
See for example this parahgraph in

    To quote RFC 1912, "A common mistake is thinking that a wildcard
    MX for a zone will apply to all hosts in the zone. A wildcard
    MX will apply only to names in the zone which aren't listed in
    the DNS at all." That is, if there is a wild card MX for
    *.example.com, and an A record (but no MX record) for
    www.example.com, the correct response (as per RFC 1034) to an
    MX request for www.example.com is "no error, but no data"; the
    expected response is the MX record attached to *.example.com.

In other words, the existence of the a.b.c.myzone.fr RPZ record
requires that the *.fr wildcard not match any sub-domain of myzone.fr.

To get what I understand to be the desired (albeit surprising)
results, try:
    a.b.c.myzone.fr     CNAME   a.b.c.myzone.fr.
    *.a.b.c.myzone.fr   A
    *.b.c.myzone.fr     A
    *.c.myzone.fr       A
    *.fr                A

Vernon Schryver    vjs at rhyolite.com

More information about the DNSfirewalls mailing list