<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hi Mukund,</div><div class="">Hi John,</div><div class=""><br class=""></div><div class="">I would need a way to insert oder override a TXT record while still don’t touch all other records and let then pass through in a transparent way.</div><div class=""><br class=""></div><div class="">So just having this would be best for my use-case but this removes all other RR.</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://www.cisco.com" class="">www.cisco.com</a> TXT "CISCO-CLS=app-name:HTTP|app-class:TD”</div><div class=""><br class=""></div><div class="">As I have learned this is not going to work:</div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><a href="http://www.cisco.com" class="">www.cisco.com</a> CNAME rpz-passthru.</div><div class=""><a href="http://www.cisco.com" class="">www.cisco.com</a> TXT "CISCO-CLS=app-name:HTTP|app-class:TD”</div></blockquote><div class=""><blockquote type="cite" class=""><blockquote type="cite" class=""></blockquote></blockquote></div><div class=""><br class=""></div><div class="">and I need to take this path:</div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><a href="http://wolfgang.dns-as.org" class="">wolfgang.dns-as.org</a> A 193.34.28.108</div><div class=""><a href="http://wolfgang.dns-as.org" class="">wolfgang.dns-as.org</a> TXT "CISCO-CLS=app-name:RPZ|app-class:TD”</div></blockquote><div class=""><blockquote type="cite" class=""><blockquote type="cite" class=""></blockquote></blockquote></div><div class=""><br class=""></div><div class="">If the latter is the only solution which can’t scale as this could change without me getting a notice my approach will not work ;-((</div>If we agree that I am not doing something wrong and this seems to be a corner case does this implies the current BIND RPZ behavior works as designed or is more like a bug?<div class=""><br class=""></div><div class="">Any other idea how this could be solved or do I need to write a script running dig to constantly update the A record inside my RPZ zone file to keep it current?</div><div class=""><br class=""></div><div class="">Many thanks,</div><div class="">Wolfgang<br class=""><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 12 Oct 2015, at 10:59AM, Mukund Sivaraman <<a href="mailto:muks@isc.org" class="">muks@isc.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Wolfgang<br class=""><br class="">On Thu, Oct 08, 2015 at 11:25:14PM +0200, Wolfgang Riedel [CISCO] wrote:<br class=""><blockquote type="cite" class="">Hi Folks,<br class=""><br class="">I am currently struggling with using RPZ for inserting or overriding TXT<br class="">resource records.<br class=""><br class="">This is my goal:<br class=""><br class=""> ; do not rewrite <a href="http://www.cisco.com" class="">www.cisco.com</a> (so, PASSTHRU) and add or override<br class=""> missing metadata<br class=""> <a href="http://www.cisco.com" class="">www.cisco.com</a> CNAME rpz-passthru.<br class=""> <a href="http://www.cisco.com" class="">www.cisco.com</a> TXT "CISCO-CLS=app-name:HTTP|app-class:TD"<br class=""><br class="">What work's is that I can do one or the other but not both at the same time<br class="">if I need to use a CNAME.<br class=""><br class="">This works:<br class=""><br class=""> <a href="http://wolfgang.dns-as.org" class="">wolfgang.dns-as.org</a> A 193.34.28.108<br class=""> <a href="http://wolfgang.dns-as.org" class="">wolfgang.dns-as.org</a> TXT "CISCO-CLS=app-name:RPZ|app-class:TD"<br class=""><br class="">but in reality this will not work for CDN or load-balanced sites which don't<br class="">have fixed IP address.<br class=""><br class="">Any hint's what I am doing wrong?<br class=""></blockquote><br class="">You aren't doing anything wrong. Yours is a corner case.<br class=""><br class="">I hope I understood what you're trying to do correctly: From the zone<br class="">comment, perhaps you want the TXT query type to return the TXT RDATA<br class="">you've supplied and everything else passthru to regular processing. It<br class="">can't be done as triggers don't use the question's TYPE field.<br class=""><br class="">An alternative is to include all the RRs for that QNAME in the answer<br class="">(your second example). Yours is a weird case, because you can't use the<br class="">following in the policy zone which named wouldn't allow loading (it<br class="">won't allow CNAME to coexist):<br class=""><br class=""><a href="http://www.cisco.com" class="">www.cisco.com</a> CNAME <a href="http://www.cisco.com.akadns.net" class="">www.cisco.com.akadns.net</a>.<br class=""><a href="http://www.cisco.com" class="">www.cisco.com</a> TXT "CISCO-CLS=app-name:HTTP|app-class:TD"<br class=""><br class="">So using the A record (your second example) or adding triggers for the<br class="">target of the CNAME record chain are your best bet. As the latter<br class="">varies, perhaps the former for your region would be best.<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>Mukund<br class=""></div></div></blockquote></div><br class=""></div></div></body></html>