<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt'>
<p>On 25/08/2019 06:56, J Doe wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->Hello,
<div> </div>
<div>I have a basic question regarding RPZ on Bind 9.11.x.</div>
<div> </div>
<div>Is it possible to re-write a response on a reverse lookup ? For instance, if I considered <span><a href="http://example.com" target="_blank" rel="noreferrer">example.com</a></span><span> a "bad domain", can I write a RPZ policy so that a reverse lookup of IP's that map to <a href="http://example.com" target="_blank" rel="noreferrer">example.com</a> fails or is blocked ?</span></div>
<div> </div>
<div>I know I can do this with a forward lookup to generate NXDOMAIN:</div>
<div> </div>
<div><span style="font-family: Courier New;">; Forward resolution of: <span><a href="http://example.com" target="_blank" rel="noreferrer">example.com</a></span><span> and subdomains generates: NXDOMAIN</span></span></div>
<div><span style="font-family: Courier New;"> </span></div>
<div><span><span><span style="font-family: Courier New;"><a href="http://example.co" target="_blank" rel="noreferrer">example.co</a>m IN CNAME .</span></span></span></div>
<div><span style="font-family: Courier New;">*.<span><a href="http://example.com" target="_blank" rel="noreferrer">example.com</a></span><span> </span><span>IN CNAME .</span></span></div>
<div> </div>
<div>...but can this also be done on reverse lookups ?</div>
<div> </div>
<div>Thanks,</div>
<div> </div>
</blockquote>
<div> </div>
<div> </div>
<div>This can have disastrous affects if this is for a public network given shared hosting.</div>
<div> </div>
<div>An Australian govt dept (ASIC) ordered a s313 block on an IP couple years back, turns out that IP supplied about 2K hosts, 99.9% all of which were very legitimate, including many aussie businesses.</div>
<div> </div>
<div>And I still dont know whats worse, the clueless idiots in ASIC (who thankfully have now due to that incident lost most that power), or the clueless idiots in the ISP's networking who blindly accepted and enacted the block.</div>
<div> </div>
<div>To put it in RFC terms for non aussies, s313 is a SHOULD, and _not_ a MUST. </div>
<div>If theres genuine reason, ie mass collateral damage, you can lawfully refuse to carry out such requests.</div>
<div> </div>
<div>-- <br />
<p>Kind Regards,</p>
<p>Noel Butler</p>
<table border="1" width="748" cellspacing="0" cellpadding="5">
<tbody>
<tr>
<td style="text-align: left;"><span style="font-size: 10pt;"><small><small><small><small>This Email, including any attachments, may contain legally privileged information, therefore remains confidential and subject to copyright protected under international law. You may not disseminate, discuss, or reveal, any part, to anyone, without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments, immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message. Only <a href="http://www.adobe.com/">PDF</a> and <a href="http://en.wikipedia.org/wiki/OpenDocument">ODF</a> documents accepted, please do not send proprietary formatted documents </small></small></small></small></span></td>
</tr>
</tbody>
</table>
</div>
</body></html>