DNS RPZ triggers

[Mukund Sivaraman]

Hi ard

On Fri, Jan 27, 2017 at 08:51:14PM +0000, derasa at MSKCC.ORG wrote:
> Hi All,
> 
> Back in December 2016, I worked on a problem in which a particular hostname (a website) would not resolve from our DNS servers, but Level3, Google DNS, and OpenDNS resolved it.  It was clear that somewhere outside our network there was policy (security or otherwise) that prevented us from getting the resolution.  It was not easy to get the website owners to work on this from their side, but eventually the problem was corrected.  How this case is relevant to bind-users is that we implement RPZs and I had hoped that I could add the hostname to the RPZ zone and return to clients the IP that I knew was correct (from Level3, OpenDNS).  However, I was told by our vendor that that was no possible because RPZs only trigger when there is an actual resolution for the queried A record.
> 
> Doing some reading today, I came across Paul Vixie's (creator of DNS RPZ) article "What are the features of the DNS RPZ firewall?" on the ISC.org site (https://deepthought.isc.org/article/AA-00516/0).  There he lists the triggers that a DNS RPZ honors.  Here is the section:
> 
> In a DNS firewall based on DNS RPZ, each rule can use one of four policy triggers and specify one of four policy actions.
> 
> A response policy in DNS RPZ can be triggered as follows:
> 
>   1.          by the query name.
>   2.          by an address which would be present in a truthful response.
>   3.          by the name or address of an authoritative name server responsible for publishing the original response.
> 
> So, there it is: trigger 1 is what I was looking for.
> 
> Our DNS platform is BIND based, and I don't understand why the vendor's implementation (mostly ISC code from my understanding) does not comport itself according to Paul Vixie's specs above.  Instead it has added a dependency in which the server must receive a response in order for a response policy action to be triggered.

It is not clear which "vendor's implementation" you're talking about,
but in this case you ought to contact the vendor if it is not ISC, and
not this list. This list is about vanilla BIND.

In vanilla BIND, see the "qname-wait-recurse" option.

		Mukund
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20170128/b07aeaea/attachment.bin>