<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div class="">On Apr 11, 2017, at 2:19 AM, Manuel RamÃrez <<a href="mailto:manuel.ramirez@grupoica.com" class="">manuel.ramirez@grupoica.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class="">Hi,<br class=""><br class=""></div>I would like to allow queries for specific <a href="http://blogspot.com/" class="">blogspot.com</a> subdomains and block the rest of the queries.<br class=""></div><div class="">I have a file with several zones configured, one of those zones is the specific subdomain type "forward":<br class=""><br class=""></div><i class="">zone "<a href="http://w.blogspot.com/" class="">w.blogspot.com</a>" IN { type forward; forwarders { 213.0.184.85; 213.0.184.88; };};</i><br class=""><br class=""></div>and below i have the zone <a href="http://blogspot.com/" class="">blogspot.com</a> as master resolving an internal ip:<br class=""><br class=""><i class="">zone "<a href="http://blogspot.com/" class="">blogspot.com</a>" IN { type master; file "/var/named/data/db.sinkhole"; };</i><br class=""><br class=""><br class=""></div>But is not working, always resolves the internal ip address, i thought it evaluates the zones in order and first should forward the query for <a href="http://w.blogspot.com/" class="">w.blogspot.com</a> but is always matching the other zone.<br class=""></div>Any idea about how can i achieve my goal?<br class=""></div></div></div></div></blockquote></div><br class=""><div class="">No, order is not considered. Rather, there are two separate searches:</div><div class=""><br class=""></div><div class="">- Is there an authoritative answer available from local data? In this case, yes, because you have a sinkhole zone named "<a href="http://blogspot.com" class="">blogspot.com</a>", from which an authoritative negative answer can be derived.</div><div class="">- If the first search does not return an answer, then use the recursion algorithm, including checking the cache and checking for the most specific forwarding configuration (if any) that would apply.</div><div class=""><br class=""></div><div class="">Doing what you want is better solved using RPZ, as Tony Finch mentioned. To do this, do not define these two zone statements. Instead, define a response policy zone that says that *.<a href="http://blogspot.com" class="">blogspot.com</a> should be blocked, but that specific names (e.g. <a href="http://w.blogspot.com" class="">w.blogspot.com</a>) should be whitelisted. Read the BIND v9 ARM for details on how to accomplish this.</div><div class=""><br class=""></div><div class="">Regards,</div><div class="">Chris Buxton</div></body></html>