<div dir="ltr">From the correct email alias this time!</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 19 Jun 2023 at 16:50, Greg Choules <<a href="mailto:gregchoules@googlemail.com">gregchoules@googlemail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Lee/Sami.<div>`break-dnssec yes;` *may* also be needed in some cases. But not here as the zone isn't signed anyway.</div><div><br></div><div>The reason that "<a href="http://example.com" target="_blank">example.com</a>" works but "<a href="http://antlauncher.com" target="_blank">antlauncher.com</a>" doesn't is down to BIND needing to perform recursion and get an answer before RPZ kicks in and overwrites it (unless you specify `qname-wait-recurse no;`). "<a href="http://example.com" target="_blank">example.com</a>" actually gets an answer (from IANA) but "<a href="http://antlauncher.com" target="_blank">antlauncher.com</a>" gets REFUSED.</div><div><br></div><div>Wireshark it and see.</div><div><br></div><div>By the way, I have been testing this on 9.18.15</div><div>Cheers, Greg</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 19 Jun 2023 at 16:10, Lee <<a href="mailto:ler762@gmail.com" target="_blank">ler762@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 6/19/23, sami.rahal wrote:<br>
> Thank you Greg<br>
><br>
> I tested with other domain name to replace "SERVFAIL" with "NXDOMAIN" is it<br>
> not working<br>
<br>
You're missing "break-dnssec yes" on your response-policy stanza?<br>
You need something like<br>
response-policy { zone "rpz.mozilla"; zone "rpz.zone"; }<br>
break-dnssec yes<br>
recursive-only no<br>
qname-wait-recurse no;<br>
# enable rpz<br>
# By default, RPZ actions are applied only to DNS requests that either do not<br>
# request DNSSEC metadata (DO=0) or when no DNSSEC records are available for<br>
# request name in the original zone (not the response policy zone).<br>
# This default can be changed for all response policy zones in a view with a<br>
# break-dnssec yes clause. In that case, RPZ actions are applied regardless<br>
# of DNSSEC.<br>
#<br>
# zone "rpz.mozilla";<br>
# <a href="https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https" rel="noreferrer" target="_blank">https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https</a><br>
<br>
Regards,<br>
Lee<br>
<br>
><br>
> I use CentOS7 with BIND9.16.41<br>
><br>
><br>
><br>
> grep antlauncher db.rpz<br>
><br>
> <a href="http://antlauncher.com" rel="noreferrer" target="_blank">antlauncher.com</a> CNAME .<br>
><br>
> *.<a href="http://antlauncher.com" rel="noreferrer" target="_blank">antlauncher.com</a> CNAME .<br>
><br>
><br>
><br>
> grep example db.rpz<br>
><br>
> <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> IN CNAME .<br>
><br>
> *.<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> IN CNAME .<br>
><br>
><br>
><br>
> dig @0 <a href="http://foo.antlauncher.com" rel="noreferrer" target="_blank">foo.antlauncher.com</a><br>
><br>
><br>
><br>
> ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.10 <<>> @0<br>
> <a href="http://foo.antlauncher.com" rel="noreferrer" target="_blank">foo.antlauncher.com</a> ; (1 server found) ;; global options: +cmd ;; Got<br>
> answer:<br>
><br>
> ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54704 ;; flags: qr rd<br>
> ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1<br>
><br>
><br>
><br>
> ;; OPT PSEUDOSECTION:<br>
><br>
> ; EDNS: version: 0, flags:; udp: 4096<br>
><br>
> ;; QUESTION SECTION:<br>
><br>
> ;<a href="http://foo.antlauncher.com" rel="noreferrer" target="_blank">foo.antlauncher.com</a>. IN A<br>
><br>
><br>
><br>
> ;; Query time: 241 msec<br>
><br>
> ;; SERVER: 127.0.0.1#53(0.0.0.0)<br>
><br>
> ;; WHEN: Mon Jun 19 10:52:22 CET 2023<br>
><br>
> ;; MSG SIZE rcvd: 48<br>
><br>
><br>
><br>
> # dig @0 <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a><br>
><br>
><br>
><br>
> ; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.10 <<>> @0 <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> ; (1<br>
> server found) ;; global options: +cmd ;; Got answer:<br>
><br>
> ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9852 ;; flags: qr rd<br>
> ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2<br>
><br>
><br>
><br>
> ;; OPT PSEUDOSECTION:<br>
><br>
> ; EDNS: version: 0, flags:; udp: 4096<br>
><br>
> ;; QUESTION SECTION:<br>
><br>
> ;<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a>. IN A<br>
><br>
><br>
><br>
> ;; ADDITIONAL SECTION:<br>
><br>
> siteblockeddb. 1 IN SOA LOCALHOST.<br>
> need.to.know.only. 2016011100 43200 900 1814400 7200<br>
><br>
><br>
><br>
> ;; Query time: 347 msec<br>
><br>
> ;; SERVER: 127.0.0.1#53(0.0.0.0)<br>
><br>
> ;; WHEN: Mon Jun 19 10:52:36 CET 2023<br>
><br>
> ;; MSG SIZE rcvd: 115<br>
><br>
><br>
><br>
><br>
> De : Greg Choules <<a href="mailto:gregchoules%2Bbindusers@googlemail.com" target="_blank">gregchoules+bindusers@googlemail.com</a>><br>
> Envoyé : lundi 19 juin 2023 15:12<br>
> À : RAHAL Sami SOFRECOM <<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>><br>
> Cc : <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
> Objet : Re: replace "SERVFAIL" to "NXDOMAIN" with rpz<br>
><br>
> Hi Sami.<br>
> That's not what I said.<br>
> Yes, you can do this with RPZ if you want - it's all in the BIND ARM - but<br>
> it's not something I would do.<br>
><br>
> Cheers, Greg<br>
><br>
> On Mon, 19 Jun 2023 at 12:40,<br>
> <<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>>> wrote:<br>
> Thank you Greg<br>
> So if I understand correctly if we receive a servfail return code we can not<br>
> modify this code by nxdomain with the rpz configuration?<br>
> Regards<br>
><br>
> De : Greg Choules<br>
> <<a href="mailto:gregchoules%2Bbindusers@googlemail.com" target="_blank">gregchoules+bindusers@googlemail.com</a><mailto:<a href="mailto:gregchoules%252Bbindusers@googlemail.com" target="_blank">gregchoules%2Bbindusers@googlemail.com</a>>><br>
> Envoyé : lundi 19 juin 2023 12:02<br>
> À : RAHAL Sami SOFRECOM<br>
> <<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>>><br>
> Cc : <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
> Objet : Re: replace "SERVFAIL" to "NXDOMAIN" with rpz<br>
><br>
> That's because this domain is broken. The NS for it are:<br>
> <a href="http://antlauncher.com" rel="noreferrer" target="_blank">antlauncher.com</a><<a href="http://antlauncher.com" rel="noreferrer" target="_blank">http://antlauncher.com</a>>: type NS, class IN, ns<br>
> <a href="http://ns1626.ztomy.com" rel="noreferrer" target="_blank">ns1626.ztomy.com</a><<a href="http://ns1626.ztomy.com" rel="noreferrer" target="_blank">http://ns1626.ztomy.com</a>> (204.11.56.26)<br>
> <a href="http://antlauncher.com" rel="noreferrer" target="_blank">antlauncher.com</a><<a href="http://antlauncher.com" rel="noreferrer" target="_blank">http://antlauncher.com</a>>: type NS, class IN, ns<br>
> <a href="http://ns2626.ztomy.com" rel="noreferrer" target="_blank">ns2626.ztomy.com</a><<a href="http://ns2626.ztomy.com" rel="noreferrer" target="_blank">http://ns2626.ztomy.com</a>> (204.11.57.26)<br>
> No matter what query you send them (so far) they respond with REFUSED and<br>
> claim not to be authoritative for<br>
> "<a href="http://antlauncher.com" rel="noreferrer" target="_blank">antlauncher.com</a><<a href="http://antlauncher.com" rel="noreferrer" target="_blank">http://antlauncher.com</a>>".<br>
><br>
> Personally I would live with the SERVFAIL because it tells you that<br>
> something is wrong, not just that it doesn't exist. Then try to contact the<br>
> people who own this domain and tell them it is broken.<br>
><br>
> Cheers, Greg<br>
><br>
> On Mon, 19 Jun 2023 at 10:33,<br>
> <<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>>> wrote:<br>
> Hello<br>
> Thank you for these details Greg, by the way I worked on a problem on one of<br>
> my resolvers and there are no errors of type "SERVFAIL" currently for valid<br>
> domain names but I receive servfail for this domain name<br>
> "<a href="http://antlauncher.com" rel="noreferrer" target="_blank">antlauncher.com</a><<a href="http://antlauncher.com" rel="noreferrer" target="_blank">http://antlauncher.com</a>>" that's why I wanted to change the<br>
> return code for this domain name to "NXDOMAIN" so as not to distort the<br>
> monitoring result .<br>
> Regards<br>
> De : Greg Choules<br>
> <<a href="mailto:gregchoules%2Bbindusers@googlemail.com" target="_blank">gregchoules+bindusers@googlemail.com</a><mailto:<a href="mailto:gregchoules%252Bbindusers@googlemail.com" target="_blank">gregchoules%2Bbindusers@googlemail.com</a>>><br>
> Envoyé : lundi 19 juin 2023 10:03<br>
> À : RAHAL Sami SOFRECOM<br>
> <<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>>><br>
> Cc : <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
> Objet : Re: replace "SERVFAIL" to "NXDOMAIN" with rpz<br>
><br>
> Hi Sami.<br>
> Firstly, a couple of definitions:<br>
> NXDOMAIN is a response from an authoritative server (or a resolver because<br>
> it cached it). It is a positive confirmation that "this name does not<br>
> exist". It means that the QNAME in the query cannot be found, for any record<br>
> type.<br>
> SERVFAIL is a response from a recursive server meaning "I tried my best to<br>
> get a response to your query but I just failed".<br>
><br>
> So if your monitoring tool, whatever it is, is receiving SERVFAIL responses<br>
> from your DNS server then you need to fix whatever is causing those in the<br>
> server.<br>
> Causes of SERVFAIL could be that your server cannot contact the<br>
> authoritative server(s) that should know the answer. Or it might be because<br>
> your server is trying to do DNSSEC validation and that is failing.<br>
> The best way to know *why* you are getting SERVFAIL would be to take a<br>
> packet capture that includes the client queries to the server and any<br>
> queries the server makes to try and get answers, plus all the responses.<br>
> Please do that and share the results, using real domains, not examples.<br>
><br>
> Hope that helps, Greg<br>
><br>
><br>
> On Mon, 19 Jun 2023 at 09:39,<br>
> <<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>>> wrote:<br>
> Hello Thank you for your feedback,<br>
> yes it works like that! for that does not work for a domain name that<br>
> already has the return code "SERVFAIL" and we want to change this code by<br>
> "NXDDOMAIN" like this domain name "<a href="http://antlauncher.com" rel="noreferrer" target="_blank">antlauncher.com</a><<a href="http://antlauncher.com" rel="noreferrer" target="_blank">http://antlauncher.com</a>>"<br>
> regards Rahal<br>
><br>
> -----Message d'origine-----<br>
> De : bind-users<br>
> <<a href="mailto:bind-users-bounces@lists.isc.org" target="_blank">bind-users-bounces@lists.isc.org</a><mailto:<a href="mailto:bind-users-bounces@lists.isc.org" target="_blank">bind-users-bounces@lists.isc.org</a>>><br>
> De la part de<br>
> <a href="mailto:bind-users-request@lists.isc.org" target="_blank">bind-users-request@lists.isc.org</a><mailto:<a href="mailto:bind-users-request@lists.isc.org" target="_blank">bind-users-request@lists.isc.org</a>><br>
> Envoyé : samedi 17 juin 2023 06:23<br>
> À : <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
> Objet : bind-users Digest, Vol 4262, Issue 1<br>
><br>
> Send bind-users mailing list submissions to<br>
> <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
><br>
> To subscribe or unsubscribe via the World Wide Web, visit<br>
> <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
> or, via email, send a message with subject or body 'help' to<br>
><br>
> <a href="mailto:bind-users-request@lists.isc.org" target="_blank">bind-users-request@lists.isc.org</a><mailto:<a href="mailto:bind-users-request@lists.isc.org" target="_blank">bind-users-request@lists.isc.org</a>><br>
><br>
> You can reach the person managing the list at<br>
><br>
> <a href="mailto:bind-users-owner@lists.isc.org" target="_blank">bind-users-owner@lists.isc.org</a><mailto:<a href="mailto:bind-users-owner@lists.isc.org" target="_blank">bind-users-owner@lists.isc.org</a>><br>
><br>
> When replying, please edit your Subject line so it is more specific than<br>
> "Re: Contents of bind-users digest..."<br>
><br>
><br>
> Today's Topics:<br>
><br>
> 1. replace "SERVFAIL" to "NXDOMAIN" with rpz<br>
> (<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>>)<br>
> 2. Re: replace "SERVFAIL" to "NXDOMAIN" with rpz (Crist Clark)<br>
> 3. Re: replace "SERVFAIL" to "NXDOMAIN" with rpz (Fred Morris)<br>
> 4. Re: replace "SERVFAIL" to "NXDOMAIN" with rpz (Ond?ej Sur?)<br>
><br>
><br>
> ----------------------------------------------------------------------<br>
><br>
> Message: 1<br>
> Date: Fri, 16 Jun 2023 20:39:43 +0000<br>
> From: <a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>><br>
> To: "<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>>"<br>
> <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>>><br>
> Subject: replace "SERVFAIL" to "NXDOMAIN" with rpz<br>
> Message-ID:<br>
> <<a href="mailto:9c4465dc103645149093f4d3f60cf89a@sofrecom.com" target="_blank">9c4465dc103645149093f4d3f60cf89a@sofrecom.com</a><mailto:<a href="mailto:9c4465dc103645149093f4d3f60cf89a@sofrecom.com" target="_blank">9c4465dc103645149093f4d3f60cf89a@sofrecom.com</a>>><br>
> Content-Type: text/plain; charset="us-ascii"<br>
><br>
><br>
> Hello<br>
> For monitoring reasons I try to change the return code of a domain name from<br>
> "SERVFAIL" to "NXDOMAIN" with the rpz classic configuration of BIND9.16.42<br>
> as follows:<br>
> <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> IN CNAME.<br>
> *.<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> IN CNAME .<br>
> But it still doesn't work, I still have the message " SERVFAIL", is it<br>
> feasible or not please ?<br>
> Kind regards<br>
><br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL:<br>
> <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20230616/aa23b454/attachment-0001.htm" rel="noreferrer" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20230616/aa23b454/attachment-0001.htm</a>><br>
><br>
> ------------------------------<br>
><br>
> Message: 2<br>
> Date: Fri, 16 Jun 2023 20:29:16 -0700<br>
> From: Crist Clark<br>
> <<a href="mailto:cjc%2Bbind-users@pumpky.net" target="_blank">cjc+bind-users@pumpky.net</a><mailto:<a href="mailto:cjc%252Bbind-users@pumpky.net" target="_blank">cjc%2Bbind-users@pumpky.net</a>>><br>
> To: <a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>><br>
> Cc: "<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>>"<br>
> <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>>><br>
> Subject: Re: replace "SERVFAIL" to "NXDOMAIN" with rpz<br>
> Message-ID:<br>
><br>
> <CAAcrURK2=+uqQ+_AvVbiAV2jpagOhd=<a href="mailto:ozRfQ_SCazBn-rUZXig@mail.gmail.com" target="_blank">ozRfQ_SCazBn-rUZXig@mail.gmail.com</a><mailto:<a href="mailto:ozRfQ_SCazBn-rUZXig@mail.gmail.com" target="_blank">ozRfQ_SCazBn-rUZXig@mail.gmail.com</a>>><br>
> Content-Type: text/plain; charset="utf-8"<br>
><br>
> That should return a NXDOMAIN. Returning SERVFAIL is never a normal RPZ<br>
> action. Something is wrong with your configuration.<br>
><br>
> On Fri, Jun 16, 2023 at 1:39?PM<br>
> <<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>>> wrote:<br>
><br>
>><br>
>><br>
>> Hello<br>
>><br>
>> For monitoring reasons I try to change the return code of a domain<br>
>> name from "SERVFAIL" to "NXDOMAIN" with the rpz classic configuration<br>
>> of<br>
>> BIND9.16.42 as follows:<br>
>><br>
>> <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> IN CNAME.<br>
>><br>
>> *.<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> IN CNAME .<br>
>><br>
>> But it still doesn't work, I still have the message " SERVFAIL", is<br>
>> it feasible or not please ?<br>
>><br>
>> Kind regards<br>
>><br>
>><br>
>> --<br>
>> Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe<br>
>> from this list<br>
>><br>
>> ISC funds the development of this software with paid support<br>
>> subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more<br>
>> information.<br>
>><br>
>><br>
>> bind-users mailing list<br>
>> <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
>> <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
>><br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL:<br>
> <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20230616/42776b6c/attachment-0001.htm" rel="noreferrer" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20230616/42776b6c/attachment-0001.htm</a>><br>
><br>
> ------------------------------<br>
><br>
> Message: 3<br>
> Date: Fri, 16 Jun 2023 21:40:11 -0700 (PDT)<br>
> From: Fred Morris <<a href="mailto:m3047@m3047.net" target="_blank">m3047@m3047.net</a><mailto:<a href="mailto:m3047@m3047.net" target="_blank">m3047@m3047.net</a>>><br>
> To: "<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>>"<br>
> <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>>><br>
> Subject: Re: replace "SERVFAIL" to "NXDOMAIN" with rpz<br>
> Message-ID:<br>
> <alpine.LSU.2.21.2306162134190.27806@flame.m3047<mailto:<a href="mailto:alpine.LSU.2.21.2306162134190.27806@flame.m3047" target="_blank">alpine.LSU.2.21.2306162134190.27806@flame.m3047</a>>><br>
> Content-Type: text/plain; charset="utf-8"; Format="flowed"<br>
><br>
> Admittedly, since I'm writing software to do "off label" stuff with DNS I<br>
> make mistakes. But I have seen things along this line (interactions between<br>
> RPZ and regular resolution in the context of "broken" domains): in some<br>
> cases it has seemed impossible to ameliorate / mitigate SERVFAIL utilizing<br>
> RPZ.<br>
><br>
> I'll try to pay more attention and see if I can isolate a test case if the<br>
> problem recurs. (I was kind of hoping someone would have a solution!)<br>
><br>
> --<br>
><br>
> Fred Morris<br>
><br>
> On Fri, 16 Jun 2023, Crist Clark wrote:<br>
>><br>
>> That should return a NXDOMAIN. Returning SERVFAIL is never a normal<br>
>> RPZ action. Something is wrong with your configuration.<br>
>><br>
>> On Fri, Jun 16, 2023 at 1:39?PM<br>
>> <<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a><mailto:<a href="mailto:sami.rahal@sofrecom.com" target="_blank">sami.rahal@sofrecom.com</a>>> wrote:<br>
>>><br>
>>> For monitoring reasons I try to change the return code of a domain<br>
>>> name from "SERVFAIL" to "NXDOMAIN" with the rpz classic configuration<br>
>>> of<br>
>>> BIND9.16.42 as follows:<br>
>>><br>
>>> <a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> IN CNAME.<br>
>>><br>
>>> *.<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a> IN CNAME .<br>
>>><br>
>>> But it still doesn't work, I still have the message " SERVFAIL", is<br>
>>> it feasible or not please ?<br>
>>><br>
><br>
> ------------------------------<br>
><br>
> Message: 4<br>
> Date: Sat, 17 Jun 2023 07:22:50 +0200<br>
> From: Ond?ej Sur? <<a href="mailto:ondrej@isc.org" target="_blank">ondrej@isc.org</a><mailto:<a href="mailto:ondrej@isc.org" target="_blank">ondrej@isc.org</a>>><br>
> To: Fred Morris <<a href="mailto:m3047@m3047.net" target="_blank">m3047@m3047.net</a><mailto:<a href="mailto:m3047@m3047.net" target="_blank">m3047@m3047.net</a>>><br>
> Cc: <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
> Subject: Re: replace "SERVFAIL" to "NXDOMAIN" with rpz<br>
> Message-ID:<br>
> <<a href="mailto:F1DB32B3-CD74-44F3-8589-ED3386CBCA70@isc.org" target="_blank">F1DB32B3-CD74-44F3-8589-ED3386CBCA70@isc.org</a><mailto:<a href="mailto:F1DB32B3-CD74-44F3-8589-ED3386CBCA70@isc.org" target="_blank">F1DB32B3-CD74-44F3-8589-ED3386CBCA70@isc.org</a>>><br>
> Content-Type: text/plain; charset="us-ascii"<br>
><br>
> An HTML attachment was scrubbed...<br>
> URL:<br>
> <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20230617/a5b1eca8/attachment.htm" rel="noreferrer" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20230617/a5b1eca8/attachment.htm</a>><br>
> -------------- next part --------------<br>
> A non-text attachment was scrubbed...<br>
> Name: favicon.ico<br>
> Type: image/x-icon<br>
> Size: 766 bytes<br>
> Desc: not available<br>
> URL:<br>
> <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20230617/a5b1eca8/attachment.bin" rel="noreferrer" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20230617/a5b1eca8/attachment.bin</a>><br>
><br>
> ------------------------------<br>
><br>
> Subject: Digest Footer<br>
><br>
> _______________________________________________<br>
> ISC funds the development of this software with paid support subscriptions.<br>
> Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
><br>
> bind-users mailing list<br>
> <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
> <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
><br>
><br>
> ------------------------------<br>
><br>
> End of bind-users Digest, Vol 4262, Issue 1<br>
> *******************************************<br>
> --<br>
> Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from<br>
> this list<br>
><br>
> ISC funds the development of this software with paid support subscriptions.<br>
> Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
><br>
><br>
> bind-users mailing list<br>
> <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><mailto:<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
> <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
><br>
-- <br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div>
</blockquote></div>