1 ; config options 2 server: 3 target-fetch-policy: "0 0 0 0 0" 4 qname-minimisation: no 5 minimal-responses: yes 6 log-servfail: yes 7 module-config: "dns64 respip iterator" 8 ; or 9 ; module-config: "respip dns64 iterator" 10 dns64-prefix: 64:ff9b::/96 11 ; possibly as well: 12 ; response-ip: 192.0.2.66/32 always_nxdomain 13 14 rpz: 15 name: "rpz.example.com." 16 rpz-log: yes 17 rpz-log-name: "rpz.example.com" 18 zonefile: 19 TEMPFILE_NAME rpz.example.com 20 TEMPFILE_CONTENTS rpz.example.com 21 $ORIGIN example.com. 22 rpz 3600 IN SOA ns1.rpz.gotham.com. hostmaster.rpz.example.com. ( 23 1379078166 28800 7200 604800 7200 ) 24 3600 IN NS ns1.rpz.example.com. 25 3600 IN NS ns2.rpz.example.com. 26 $ORIGIN rpz.example.com. 27 ; block 192.0.2.66/32 28 32.66.2.0.192.rpz-ip IN CNAME . 29 TEMPFILE_END 30 31 stub-zone: 32 name: "." 33 stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. 34 CONFIG_END 35 36 SCENARIO_BEGIN Test RPZ filtered query with DNS64 enabled. 37 38 ; K.ROOT-SERVERS.NET. 39 RANGE_BEGIN 0 100 40 ADDRESS 193.0.14.129 41 ENTRY_BEGIN 42 MATCH opcode qtype qname 43 ADJUST copy_id 44 REPLY QR NOERROR 45 SECTION QUESTION 46 . IN NS 47 SECTION ANSWER 48 . IN NS K.ROOT-SERVERS.NET. 49 SECTION ADDITIONAL 50 K.ROOT-SERVERS.NET. IN A 193.0.14.129 51 ENTRY_END 52 53 ENTRY_BEGIN 54 MATCH opcode subdomain 55 ADJUST copy_id copy_query 56 REPLY QR NOERROR 57 SECTION QUESTION 58 tld. IN NS 59 SECTION AUTHORITY 60 tld. IN NS ns.tld. 61 SECTION ADDITIONAL 62 ns.tld. IN A 1.2.3.5 63 ENTRY_END 64 RANGE_END 65 66 ; ns.tld 67 RANGE_BEGIN 0 100 68 ADDRESS 1.2.3.5 69 ENTRY_BEGIN 70 MATCH opcode qtype qname 71 ADJUST copy_id 72 REPLY QR AA NOERROR 73 SECTION QUESTION 74 tld. IN NS 75 SECTION ANSWER 76 tld. IN NS ns.tld 77 SECTION ADDITIONAL 78 ns.tld. IN A 1.2.3.5 79 ENTRY_END 80 81 ENTRY_BEGIN 82 MATCH opcode qtype qname 83 ADJUST copy_id 84 REPLY QR AA NOERROR 85 SECTION QUESTION 86 ns.tld. IN A 87 SECTION ANSWER 88 ns.tld. IN A 1.2.3.5 89 ENTRY_END 90 91 ENTRY_BEGIN 92 MATCH opcode qtype qname 93 ADJUST copy_id 94 REPLY QR AA NOERROR 95 SECTION QUESTION 96 ns.tld. IN AAAA 97 SECTION AUTHORITY 98 tld. 3600 IN SOA ns.tld. host.tld. 20201 3600 1800 604800 3600 99 ENTRY_END 100 101 ENTRY_BEGIN 102 MATCH opcode subdomain 103 ADJUST copy_id copy_query 104 REPLY QR NOERROR 105 SECTION QUESTION 106 example.tld. IN NS 107 SECTION AUTHORITY 108 example.tld. 5 IN NS ns.example.tld. 109 SECTION ADDITIONAL 110 ns.example.tld. 5 IN A 1.2.3.4 111 ENTRY_END 112 RANGE_END 113 114 ; ns.example.tld. 115 RANGE_BEGIN 0 100 116 ADDRESS 1.2.3.4 117 ENTRY_BEGIN 118 MATCH opcode qtype qname 119 ADJUST copy_id 120 REPLY QR NOERROR 121 SECTION QUESTION 122 example.tld. IN NS 123 SECTION ANSWER 124 example.tld. 86400 IN NS ns.example.tld. 125 SECTION ADDITIONAL 126 ns.example.tld. 86400 IN A 1.2.3.4 127 ENTRY_END 128 129 ENTRY_BEGIN 130 MATCH opcode qtype qname 131 ADJUST copy_id 132 REPLY QR AA NOERROR 133 SECTION QUESTION 134 ns.example.tld. IN A 135 SECTION ANSWER 136 ns.example.tld. IN A 1.2.3.4 137 ENTRY_END 138 139 ENTRY_BEGIN 140 MATCH opcode qtype qname 141 ADJUST copy_id 142 REPLY QR AA NOERROR 143 SECTION QUESTION 144 ns.example.tld. IN AAAA 145 SECTION AUTHORITY 146 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 147 ENTRY_END 148 149 ENTRY_BEGIN 150 MATCH opcode qtype qname 151 ADJUST copy_id 152 REPLY QR AA NOERROR 153 SECTION QUESTION 154 bad.example.tld. IN A 155 SECTION ANSWER 156 bad.example.tld. IN A 192.0.2.66 157 ENTRY_END 158 159 ENTRY_BEGIN 160 MATCH opcode qtype qname 161 ADJUST copy_id 162 REPLY QR AA NOERROR 163 SECTION QUESTION 164 bad.example.tld. IN AAAA 165 SECTION AUTHORITY 166 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 167 ENTRY_END 168 169 ENTRY_BEGIN 170 MATCH opcode qtype qname 171 ADJUST copy_id 172 REPLY QR AA NOERROR 173 SECTION QUESTION 174 synth.example.tld. IN A 175 SECTION ANSWER 176 synth.example.tld. IN A 203.0.113.5 177 ENTRY_END 178 179 ENTRY_BEGIN 180 MATCH opcode qtype qname 181 ADJUST copy_id 182 REPLY QR AA NOERROR 183 SECTION QUESTION 184 synth.example.tld. IN AAAA 185 SECTION AUTHORITY 186 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 187 ENTRY_END 188 189 ENTRY_BEGIN 190 MATCH opcode qtype qname 191 ADJUST copy_id 192 REPLY QR AA NOERROR 193 SECTION QUESTION 194 clean.example.tld. IN A 195 SECTION ANSWER 196 clean.example.tld. IN A 203.0.113.5 197 ENTRY_END 198 199 ENTRY_BEGIN 200 MATCH opcode qtype qname 201 ADJUST copy_id 202 REPLY QR AA NOERROR 203 SECTION QUESTION 204 clean.example.tld. IN AAAA 205 SECTION AUTHORITY 206 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 207 ENTRY_END 208 RANGE_END 209 210 STEP 1 QUERY 211 ENTRY_BEGIN 212 REPLY RD NOERROR 213 SECTION QUESTION 214 bad.example.tld. IN A 215 ENTRY_END 216 217 ; RPZ works on A query 218 STEP 2 CHECK_ANSWER 219 ENTRY_BEGIN 220 MATCH all 221 REPLY QR RD RA NXDOMAIN 222 SECTION QUESTION 223 bad.example.tld. IN A 224 SECTION ANSWER 225 ENTRY_END 226 227 STEP 10 QUERY 228 ENTRY_BEGIN 229 REPLY RD NOERROR 230 SECTION QUESTION 231 synth.example.tld. IN AAAA 232 ENTRY_END 233 234 ; DNS64 synthesizes an unblocked address. 235 STEP 11 CHECK_ANSWER 236 ENTRY_BEGIN 237 MATCH all 238 REPLY QR RD RA NOERROR 239 SECTION QUESTION 240 synth.example.tld. IN AAAA 241 SECTION ANSWER 242 synth.example.tld. 3600 IN AAAA 64:ff9b::cb00:7105 243 ENTRY_END 244 245 STEP 20 QUERY 246 ENTRY_BEGIN 247 REPLY RD NOERROR 248 SECTION QUESTION 249 bad.example.tld. IN AAAA 250 ENTRY_END 251 252 ; synthesized AAAA for A that is blocked by RPZ. 253 STEP 21 CHECK_ANSWER 254 ;ENTRY_BEGIN 255 ;MATCH all 256 ;REPLY QR RD RA NXDOMAIN 257 ;SECTION QUESTION 258 ;bad.example.tld. IN AAAA 259 ;SECTION ANSWER 260 ;ENTRY_END 261 ENTRY_BEGIN 262 MATCH all 263 REPLY QR RD RA NOERROR 264 SECTION QUESTION 265 bad.example.tld. IN AAAA 266 SECTION AUTHORITY 267 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 268 ENTRY_END 269 270 STEP 30 QUERY 271 ENTRY_BEGIN 272 REPLY RD NOERROR 273 SECTION QUESTION 274 bad.example.tld. IN AAAA 275 ENTRY_END 276 277 ; same from cache. 278 STEP 31 CHECK_ANSWER 279 ENTRY_BEGIN 280 MATCH all 281 REPLY QR RD RA NOERROR 282 SECTION QUESTION 283 bad.example.tld. IN AAAA 284 SECTION AUTHORITY 285 example.tld. 3600 IN SOA ns.example.tld. host.example.tld. 20301 3600 1800 604800 3600 286 ENTRY_END 287 288 SCENARIO_END 289
Indexes created Mon Oct 26 00:26:21 UTC 2026