<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.28.3">
</HEAD>
<BODY>
On Wed, 2012-12-05 at 09:13 +0000, Phil Mayers wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
On 12/04/2012 06:35 PM, Barry S. Finkel wrote:
> A question from the OP that has not yet been answered -
> Make the zones masters on all servers.
Surely not for RPZ? The whole point with RPZ is that you have one zone
containing all the blacklists, master in one place, and slave it in all
the others.
For traditional DNS blacklisting (one zone per blacklisted name/suffix)
sure, but I'm honestly not sure why anyone would start out down that
road today with RPZ available.
_
</PRE>
</BLOCKQUOTE>
<BR>
response times would be a good reason<BR>
an RPZ zone still goes through the motions<BR>
<BR>
forged (local empty) zone:<BR>
dig mmmm.xxxtoolbar.com<BR>
<snip><BR>
;; Query time: 0 msec<BR>
<BR>
(all local zones hte same , 0 msec)<BR>
<BR>
RPZ:<BR>
dig bobi.at<BR>
;; Query time: 996 msec<BR>
<BR>
(avg response time it seems for RPZ'd zones)<BR>
<BR>
So it sure as hell doesnt work the same as a forged "empty" zones<BR>
<BR>
RPZ is awesome if you want to wallgarden a hostname, but for just speedy dropping, empty zone beats it hands down even if it is messier requiring its own zone.<BR>
<BR>
</BODY>
</HTML>