<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
I did not know about RPZ Here is a good configuration example:<br><br>http://jpmens.net/2011/04/26/how-to-configure-your-bind-resolvers-to-lie-using-response-policy-zones-rpz/<br><br>IMHO (and I am really nobody) THIS IS WRONG! BAD BAD BAD! Your giving companies the ability to selective lie about DNS without the end user knowing it. Unfortunately (and I have the heights and greatest respect for Paul) but after reading this http://www.isc.org/community/blog/201007/taking-back-dns-0 I can only think of one thing. China.<br><br>You just handed DNS on a silver platter to oppressive governments and corporations.<br><br>RBL's were great because they block unsolicited email. They user did not request it, but it was sent to their email when it was exposed.<br><br>with RPZ, a user makes a request, and being re-directed. Paul, no matter what you do, you will never be-able to technologically over come dumb or malicious users, especially since 99% of all corporate espionage/hacks are done internally, by a user with full access so.... <br><br>We are a small company (so again I apologies for my naivete) but the real solutions is well informed users, a good corporate policy, which makes sure user are aware of and held accountable for their clicks. <br><br>I mean Imagine if your GPS device took you to a different restaurant cause to thought the food was better.<br><br>Sorry for getting off topic and ranting, but these are the kinds of techs that make the hair on my neck stand up.<br><br><br><div><div id="SkyDrivePlaceholder"></div><hr id="stopSpelling">Date: Tue, 5 Feb 2013 15:52:51 +0000<br>Subject: Re: Selective resolution in a corporate environment<br>From: wongsky.monkey@gmail.com<br>To: bind-users@lists.isc.org<br><br><font face="Courier"><font face="Courier"><div dir="LTR">> From: Phil Mayers <a href="mailto:p.mayers@imperial.ac.uk">p.mayers@imperial.ac.uk</a></div><div dir="LTR">> To: <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>,</div>
<div dir="LTR">> Date: 05/02/2013 15:44</div><div dir="LTR">> Subject: Re: Selective resolution in a corporate environment</div><div dir="LTR">> <br>
> On 05/02/13 15:36, funky monkey wrote:<br>
> <br>
> > Could you sandwich that in a forwarding chain - say have a bind<br>
> > 9.<compliant version> in between your normal forwarders to internet, and<br>
> > does it just look fo rthe entries you've specified as either alternate<br>
> > data or does not exist, but otherwise, carries on to forward to an<br>
> > authoritative (or cached, I suppose) version of the domain in question?<br>
> <br>
> Not entirely sure what you're asking, but I don't see any reason you <br>
> couldn't use "forwarders { ... };" to point to an RPZ-enabled server, <br>
> which would be handy to retrofit into bind < 9.8 installations.</div><div dir="LTR"> </div><div dir="LTR">Sorry, should have probably explained my scenario better... my internal nameservers have a sort of top level (placeholder domain) that are Windows DNS servers, that forward out internet DNS servers for public DNS and anything not resolved internally (by means of either conditional forwarding, or stub zones). All other DNS environments in the organisation (be the BIND or Windows DNS, forward to these 2 "top level" (internal) DNS servers, and only they talk DNS through the firewall to internet DNS.</div>
<div dir="LTR"> </div><div dir="LTR">So what I meant was for these 2 DNS servers that go on to forward to the internet, rather than directly forwarding to the internet, forwarding to one (or more) RPZ enabled BIND 9.x servers, which in turn forward on to the internet for anything not specified locally. So say I wanted to resolve <a href="http://fred.domain.com" target="_blank">fred.domain.com</a>. from something internal, and only <a href="http://www.domain.dom" target="_blank">www.domain.dom</a>. was specified (kind of as subversion) on these RPZ servers, that not finding a match, they would carry on to attempt to resolve <a href="http://fred.domain.com" target="_blank">fred.domain.com</a>. from the authoriative <a href="http://domain.com" target="_blank">domain.com</a>. nameservers (or the first intermediate DNS server that happens to be caching).</div>
<div dir="LTR"> </div><div dir="LTR">Hope I've asked that in a bit of a clearer manner!</div><div dir="LTR"> </div><div dir="LTR">Cheers</div></font></font>
<br>_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users</div> </div></body>
</html>