DNS RPZ triggers

derasa at MSKCC.ORG derasa at MSKCC.ORG
Fri Jan 27 20:51:14 UTC 2017

Hi All,

Back in December 2016, I worked on a problem in which a particular hostname (a website) would not resolve from our DNS servers, but Level3, Google DNS, and OpenDNS resolved it.  It was clear that somewhere outside our network there was policy (security or otherwise) that prevented us from getting the resolution.  It was not easy to get the website owners to work on this from their side, but eventually the problem was corrected.  How this case is relevant to bind-users is that we implement RPZs and I had hoped that I could add the hostname to the RPZ zone and return to clients the IP that I knew was correct (from Level3, OpenDNS).  However, I was told by our vendor that that was no possible because RPZs only trigger when there is an actual resolution for the queried A record.

Doing some reading today, I came across Paul Vixie's (creator of DNS RPZ) article "What are the features of the DNS RPZ firewall?" on the ISC.org site (https://deepthought.isc.org/article/AA-00516/0).  There he lists the triggers that a DNS RPZ honors.  Here is the section:

In a DNS firewall based on DNS RPZ, each rule can use one of four policy triggers and specify one of four policy actions.

A response policy in DNS RPZ can be triggered as follows:

  1.          by the query name.
  2.          by an address which would be present in a truthful response.
  3.          by the name or address of an authoritative name server responsible for publishing the original response.

So, there it is: trigger 1 is what I was looking for.

Our DNS platform is BIND based, and I don't understand why the vendor's implementation (mostly ISC code from my understanding) does not comport itself according to Paul Vixie's specs above.  Instead it has added a dependency in which the server must receive a response in order for a response policy action to be triggered.

Has anyone here had any experience with this behavior, or do you think the vendor must add this "feature" to its BIND flavor?



     Please note that this e-mail and any files transmitted from
     Memorial Sloan Kettering Cancer Center may be privileged, confidential,
     and protected from disclosure under applicable law. If the reader of
     this message is not the intended recipient, or an employee or agent
     responsible for delivering this message to the intended recipient,
     you are hereby notified that any reading, dissemination, distribution,
     copying, or other use of this communication or any of its attachments
     is strictly prohibited.  If you have received this communication in
     error, please notify the sender immediately by replying to this message
     and deleting this message, any attachments, and all copies and backups
     from your computer.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20170127/ef6c51ba/attachment.html>

More information about the bind-users mailing list