[DNSfirewalls] A non RPZ DNS firewall question

[Fred Morris]

On Fri, 29 Jul 2022, Francis Turner via DNSfirewalls wrote:
> At least I don’t think it’s an RPZ question because I don’t believe it is part of the spec.

Agree with Paul, although policywise it makes sense I think the spec was 
guided by technical constraints.

(I suspect Francis knows this) you can set up an RPZ to return records of 
a certain type if that type is queried for.

> Is it possible in Bind or other DNS servers to filter based on RRTYPE e.g. always replying NXDOMAIN to TXT queries or for that
> matter to other arbitrary TYPEXX queries?

This actually doesn't sound like eye-rollingly bad deep packet inspection 
to me. Why not just route them to a properly bodged server behind the 
"load balancer" (that would be the place to use RPZ)?

--

Fred Morris