No subject

[funky monkey]

> From: Phil Mayers <p.mayers at imperial.ac.uk>

> To: bind-users at lists.isc.org,

> Date: 05/02/2013 15:26
> Subject: Re: Selective resolution in a corporate environment
>
> On 05/02/13 15:16, funky monkey wrote:
>
> > But to get back to what I'm often asked for, more as a tactical
> > solution, is there any way of being able to subvert specific DNS names
> > with alternate responses, whilst leaving the rest of the resolution to
> > be obtained in the normal way - I know that doesn't follow the normal
> > looking for authority for a domain name, then asking the correct
> > question there.
>
> RPZ. It's present in bind 9.8 and 9.9, and can filter queries and
> responses to an (intentionally) limited degree.
>
> Basically you define a response-policy statement in the config. That
> statement lists one or more zones e.g. "rpz.yoursite.org". Queries and
> answers are passed through that zone looking for specially formatted
> records, and answers rewritten or turned into NODATA/NXDOMAIN as required.

Could you sandwich that in a forwarding chain - say have a bind
9.<compliant version> in between your normal forwarders to internet, and
does it just look fo rthe entries you've specified as either alternate data
or does not exist, but otherwise, carries on to forward to an authoritative
(or cached, I suppose) version of the domain in question?

Thanks for the responses so far, by the way.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20130205/c91db2f4/attachment.html>