DNS RPZ triggers

[derasa at MSKCC.ORG]

Mukund,

Thanks for pointing out the qname-wait-recurse setting.  I checked the config for the RPZ zones and it set to "no".

ard
-----Original Message-----
From: Mukund Sivaraman [mailto:muks at isc.org] 
Sent: Friday, January 27, 2017 9:59 PM
To: Deras, Angel R./Information Systems
Cc: bind-users at lists.isc.org
Subject: Re: DNS RPZ triggers

Hi ard

On Fri, Jan 27, 2017 at 08:51:14PM +0000, derasa at MSKCC.ORG wrote:
> Hi All,
> 
> Back in December 2016, I worked on a problem in which a particular hostname (a website) would not resolve from our DNS servers, but Level3, Google DNS, and OpenDNS resolved it.  It was clear that somewhere outside our network there was policy (security or otherwise) that prevented us from getting the resolution.  It was not easy to get the website owners to work on this from their side, but eventually the problem was corrected.  How this case is relevant to bind-users is that we implement RPZs and I had hoped that I could add the hostname to the RPZ zone and return to clients the IP that I knew was correct (from Level3, OpenDNS).  However, I was told by our vendor that that was no possible because RPZs only trigger when there is an actual resolution for the queried A record.
> 
> Doing some reading today, I came across Paul Vixie's (creator of DNS RPZ) article "What are the features of the DNS RPZ firewall?" on the ISC.org site (https://deepthought.isc.org/article/AA-00516/0).  There he lists the triggers that a DNS RPZ honors.  Here is the section:
> 
> In a DNS firewall based on DNS RPZ, each rule can use one of four policy triggers and specify one of four policy actions.
> 
> A response policy in DNS RPZ can be triggered as follows:
> 
>   1.          by the query name.
>   2.          by an address which would be present in a truthful response.
>   3.          by the name or address of an authoritative name server responsible for publishing the original response.
> 
> So, there it is: trigger 1 is what I was looking for.
> 
> Our DNS platform is BIND based, and I don't understand why the vendor's implementation (mostly ISC code from my understanding) does not comport itself according to Paul Vixie's specs above.  Instead it has added a dependency in which the server must receive a response in order for a response policy action to be triggered.

It is not clear which "vendor's implementation" you're talking about, but in this case you ought to contact the vendor if it is not ISC, and not this list. This list is about vanilla BIND.

In vanilla BIND, see the "qname-wait-recurse" option.

		Mukund

=====================================================================

     Please note that this e-mail and any files transmitted from
     Memorial Sloan Kettering Cancer Center may be privileged, confidential,
     and protected from disclosure under applicable law. If the reader of
     this message is not the intended recipient, or an employee or agent
     responsible for delivering this message to the intended recipient,
     you are hereby notified that any reading, dissemination, distribution,
     copying, or other use of this communication or any of its attachments
     is strictly prohibited.  If you have received this communication in
     error, please notify the sender immediately by replying to this message
     and deleting this message, any attachments, and all copies and backups
     from your computer.