scripts-to-block-domains

[MEjaz]

Hello all, 

 

Thanks for every one's  contribution.  I use RPZ and listed 5000  forged
domain to block it in  a particular zone  without having addiotnal zones, I
hope that's the feature of  RPZ, Seems good. 

 

Below is snippet for your review  for the zone and file  db.rpz.local which
was copied from the default named.empty. 

 

zone "rpz.local" {

    type master;

    file "db.rpz.local";

    allow-query { localhost; };

};

 

 



 

 

 

Once this configuration done I am expecting that whoever quarried to our
name server for a zone which Is listed in my dns server should not allow
users to fetch any records as recursive from outside servers, it should
server from the internal servers only? 

 

When I test my configuration with one of the hosted domain in my list i.e
doubleclick.net, I got all the results rather than throwing an error. please
correct if I am wrong.. 

 

 

 



 

 

Here are the logs. 

 

[root at ns20 ~]# tailf /var/log/named/rpz.log

14-Jul-2020 06:49:53.582 rpz: info: client 212.71.32.20#38120: rpz QNAME
NXDOMAIN rewrite test.doubleclick.net via test.doubleclick.net.rpz.local

14-Jul-2020 06:49:55.370 rpz: info: client 213.210.231.227#26654: rpz QNAME
NXDOMAIN rewrite securepubads.g.doubleclick.net via
securepubads.g.doubleclick.net.rpz.local

14-Jul-2020 06:50:04.445 rpz: info: client 212.71.32.20#48178: rpz QNAME
NXDOMAIN rewrite mail.doubleclick.net via mail.doubleclick.net.rpz.local

14-Jul-2020 06:50:09.079 rpz: info: client 213.210.231.227#16492: rpz QNAME
NXDOMAIN rewrite stats.g.doubleclick.net via
stats.g.doubleclick.net.rpz.local

c14-Jul-2020 06:52:07.353 rpz: info: client 213.210.253.163#58635: rpz QNAME
NXDOMAIN rewrite stats.l.doubleclick.net via
stats.l.doubleclick.net.rpz.local

14-Jul-2020 06:52:25.272 rpz: info: client 213.210.253.163#57975: rpz QNAME
NXDOMAIN rewrite pagead.l.doubleclick.net via
pagead.l.doubleclick.net.rpz.local

14-Jul-2020 06:55:03.973 rpz: info: client 213.181.164.207#31366: rpz QNAME
NXDOMAIN rewrite googleads.g.doubleclick.net via
googleads.g.doubleclick.net.rpz.local

 

 

 

-----Original Message-----
From: bind-users [mailto:bind-users-bounces at lists.isc.org] On Behalf Of
Grant Taylor via bind-users
Sent: Monday, July 13, 2020 10:45 PM
To: bind-users at lists.isc.org
Subject: Re: scripts-to-block-domains

 

On 7/13/20 12:44 AM, MEjaz wrote:

> Hell  all,

 

Hi,

 

> I have an requirement from our  national Cyber security to block 

> several thousand forged domains from our recursive servers, Is there 

> any way we can add clause in named.conf to scan such bogus domain list 

> without impacting the performance of the servers.

 

$RPZ++

 

If you can't use RPZ, then you /can/ create skeleton zones to make your
server authoritative for the zones in question.  However, there are
drawbacks to this regarding performance based on the number and size of all
the additional zones.

 

I would strongly recommend RPZ, or the new Response Policy Service, which
there are a few commercial implementations of.  RPS is for DNS what milters
are for mail servers.

 

   RPZ is a ""static list.

   RPS is an active / dynamic service.

 

Note:  Response Policy Zones can be updated via normal dynamic DNS methods.

 

 

 

--

Grant. . . .

unix || die

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20200714/6c08f111/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 18182 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20200714/6c08f111/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 18277 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20200714/6c08f111/attachment-0003.png>