[DNSfirewalls] A non RPZ DNS firewall question
m3047 at m3047.net
Sat Jul 30 02:51:44 UTC 2022
On Fri, 29 Jul 2022, Francis Turner via DNSfirewalls wrote:
> At least I don’t think it’s an RPZ question because I don’t believe it is part of the spec.
Agree with Paul, although policywise it makes sense I think the spec was
guided by technical constraints.
(I suspect Francis knows this) you can set up an RPZ to return records of
a certain type if that type is queried for.
> Is it possible in Bind or other DNS servers to filter based on RRTYPE e.g. always replying NXDOMAIN to TXT queries or for that
> matter to other arbitrary TYPEXX queries?
This actually doesn't sound like eye-rollingly bad deep packet inspection
to me. Why not just route them to a properly bodged server behind the
"load balancer" (that would be the place to use RPZ)?
More information about the DNSfirewalls