<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:423577793;
mso-list-template-ids:-225962822;}
@list l0:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi All,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Back in December 2016, I worked on a problem in which a particular hostname (a website) would not resolve from our DNS servers, but Level3, Google DNS, and OpenDNS resolved it. It was clear that somewhere outside our network there was
policy (security or otherwise) that prevented us from getting the resolution. It was not easy to get the website owners to work on this from their side, but eventually the problem was corrected. How this case is relevant to bind-users is that we implement
RPZs and I had hoped that I could add the hostname to the RPZ zone and return to clients the IP that I knew was correct (from Level3, OpenDNS). However, I was told by our vendor that that was no possible because RPZs only trigger when there is an actual resolution
for the queried A record.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Doing some reading today, I came across Paul Vixie’s (creator of DNS RPZ) article “What are the features of the DNS RPZ firewall?” on the ISC.org site (<a href="https://deepthought.isc.org/article/AA-00516/0">https://deepthought.isc.org/article/AA-00516/0</a>).
There he lists the triggers that a DNS RPZ honors. Here is the section:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In a DNS firewall based on DNS RPZ, each rule can use one of four policy triggers and specify one of four policy actions.<br>
<br>
A response policy in DNS RPZ can be triggered as follows:<o:p></o:p></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoNormal" style="mso-list:l0 level1 lfo1"> by the query name.<o:p></o:p></li><li class="MsoNormal" style="mso-list:l0 level1 lfo1"> by an address which would be present in a truthful response.<o:p></o:p></li><li class="MsoNormal" style="mso-list:l0 level1 lfo1"> by the name or address of an authoritative name server responsible for publishing the original response.<o:p></o:p></li></ol>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So, there it is: trigger 1 is what I was looking for.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Our DNS platform is BIND based, and I don’t understand why the vendor’s implementation (mostly ISC code from my understanding) does not comport itself according to Paul Vixie’s specs above. Instead it has added a dependency in which the
server must receive a response in order for a response policy action to be triggered.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Has anyone here had any experience with this behavior, or do you think the vendor must add this “feature” to its BIND flavor?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">ard<o:p></o:p></p>
</div>
<P>=====================================================================<br/>
<br/>
Please note that this e-mail and any files transmitted from<br/>
Memorial Sloan Kettering Cancer Center may be privileged, confidential,<br/>
and protected from disclosure under applicable law. If the reader of<br/>
this message is not the intended recipient, or an employee or agent<br/>
responsible for delivering this message to the intended recipient,<br/>
you are hereby notified that any reading, dissemination, distribution,<br/>
copying, or other use of this communication or any of its attachments<br/>
is strictly prohibited. If you have received this communication in<br/>
error, please notify the sender immediately by replying to this message<br/>
and deleting this message, any attachments, and all copies and backups<br/>
from your computer.<br/></P></body>
</html>