<html>Lee, thanks for your quick answer.<br />I applied the policy based on rpz-nsip trigger instead of mg.gov.br QNAME because of some others situations in my environment. Like I said earlier, the doubt is why when there's no forward zone the trigger works properly? In my opinion it should'nt have different behaviour just because of forward zone, at least I can't imagine why this is happening.<br />The Bind version deployed is 9.11.4, I was imagining It could be a bug, and It seems bind 9.12 version has a fix related to this problem, but I'm not sure.<br /><br /> thanks one more time.<br /><br /><br /><br /><font size="3"><b>Miguel Moreira</b><br />Gerente</font><br /><font size="3">DPR/SRE/GSR - Gerência de Serviços de Rede<br />+55(31)3339-1401<br />PRODEMGE - Companhia de Tecnologia da Informação do Estado de Minas Gerais</font><br /><br /><br /><font size="2">Aviso: Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação sigilosa e legalmente protegida. O uso impróprio será tratado conforme as normas da empresa e a legislação em vigor. Caso não seja o destinatário, favor notificar o remetente, ficando proibidas a utilização, divulgação, cópia e distribuição.</font> Em Segunda, Março 25, 2019 18:37 -03, Lee <ler762@gmail.com> escreveu:<blockquote type="cite" cite="CAD8GWsthdZsJODQ=4QOZUJfoRh0jHFyZPoy6STfTgYW5=2-3=w@mail.gmail.com">On 3/25/19, Miguel Mucio Santos Moreira wrote:<br />><br />> Hello everybody!<br /><br />Hi!<br /><br />> I have a problem with DNS-RPZ and forward zone working together.<br />> I've created a rpz zone with the following trigger on my recursive DNS<br />> Server:<br />> 18.0.0.198.200.rpz-nsip IN CNAME rpz-passthru.<br /><br />Which means anybody can answer with a 200.198.0.0/18 address and it<br />will be accepted. .. probably not what you want.<br /><br />> It means any query response comming from a DNS Server which IP address<br />> matching with the any IP address at entire CIDR block 200.198.0.0/18 will be<br />> answered with rpz-passthru<br />> It works perfectly for any domain hosted in my Authoritative DNS Servers.<br />> But when I apply on my recursive RPZ DNS Server a forward zone for those<br />> domains hosted on my Authoritative DNS Servers the problems appear and it is<br />> very weird.<br />><br />> I have a mg.gov.br domain<br /><br />I'd go with<br /><br />mg.gov.br IN CNAME rpz-passthru.<br />-- it's your domain so hopefully you can trust whatever answers it gives<br />18.0.0.198.200.rpz-nsip IN CNAME .<br />-- nobody else gets to answer with your address space<br /><br />Regards,<br />Lee<br /><br />> and its NS Servers are zeus.prodemge.gov.br<br />> (200.198.5.13), titanio.prodemge.gov.br (200.198.5.5), tupan.prodemge.gov.br<br />> (200.198.4.4) and jupiter.prodemge.gov.br (200.198.5.2).<br />> If I perform a dig at my workstation using Recursive DNS with RPZ looking<br />> for any record in mg.gov.br domain, rpz-passthru policy is not applied,<br />> however if I perform a dig looking for any record in prodemge.gov.br domain<br />> and after that I perform the same dig before it works properly.<br />><br />><br />> Note: Recursive DNS Servers and Authoritative DNS Servers are not the same.<br />><br />> As workaround solution I applied 4 rpz-nsdname triggers above that one<br />> mentioned in the begining this email with my authoritative name servers with<br />> rpz-passthru policy.<br />> titanio.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />> jupiter.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />> tupan.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />> zeus.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />><br />> I would like to understand why it didn't work without workaround solution,<br />> anyone has any idea about it?<br />><br />> Thanks in advance<br />> --<br />><br />> Miguel Moreira<br />> Gerente<br />> DPR/SRE/GSR - Gerência de Serviços de Rede<br />> +55(31)3339-1401<br />> PRODEMGE - Companhia de Tecnologia da Informação do Estado de Minas Gerais<br />><br />><br />> Aviso: Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é<br />> dirigida, podendo conter informação sigilosa e legalmente protegida. O uso<br />> impróprio será tratado conforme as normas da empresa e a legislação em<br />> vigor. Caso não seja o destinatário, favor notificar o remetente, ficando<br />> proibidas a utilização, divulgação, cópia e distribuição.<br />></blockquote></html>