<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body ><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10pt;"><div>Hi Ondrej,<br></div><div><br></div><div>Thank you for your response. <br></div><div><br></div><div>Each listed domain in the RPZ is rewritten via a CNAME to a single policy domain, and that policy domain has an A record in its authoritative zone.<br></div><div><br></div><div>For example:<br></div><div><br></div><div>bad-domain1.example. CNAME policy.example.net.<br></div><div>bad-domain2.example. CNAME policy.example.net.<br></div><div>bad-domain3.example. CNAME policy.example.net.<br></div><div>bad-domain4.example. CNAME policy.example.net.<br></div><div><br></div><div>and in the authoritative zone:<br></div><div><br></div><div>policy.example.net. A <IP address><br></div><div><br></div><div><br></div><div>The same RPZ ruleset works correctly on BIND 9.20.23, while BIND 9.20.26 logs the rewrite failure for the same query.<br></div><div><br></div><div>Regards,<br></div><div>Sachchidanand Upadhyay</div><div><br></div><div><br></div><div><br></div><div><br></div><div class="zmail_extra_hr" style="border-top: 1px solid rgb(204, 204, 204); height: 0px; margin-top: 10px; margin-bottom: 10px; line-height: 0px;"><br></div><div class="zmail_extra" data-zbluepencil-ignore="true"><div><br></div><div id="Zm-_Id_-Sgn1">From: Ondřej Surý <ondrej@isc.org><br>To: "Sachchidanand Upadhyay"<supadhyay@nkn.in><br>Cc: "bind-users"<bind-users@lists.isc.org><br>Date: Fri, 24 Jul 2026 17:12:09 +0530<br>Subject: Re: Different RPZ behavior for IDN domains between BIND 9.20.23 and 9.20.26<br></div><div><br></div><blockquote style="margin: 0px;" id="blockquote_zmail"><div dir="auto">What is the rule to trigger this? It is hard to debug without seeing the exact ruleset that’s being used.<div><br></div><div>Ondrej<br id="x_380161398lineBreakAtBeginningOfSignature"><div dir="ltr"><span class="highlight" style="background-color:rgba(255, 255, 255, 0)">--<br>Ondřej Surý (He/Him)<br><span dir="ltr"><a target="_blank" href="mailto:ondrej@isc.org">ondrej@isc.org</a></span><br><br>ADHD brain at work: I sometimes lose track of my inbox. Please feel free to send a gentle nudge if you're waiting on a reply!<br><br>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</span><br style="font-size: 17px"></div><div dir="ltr"><br><blockquote>On 24. 7. 2026, at 13:04, Sachchidanand Upadhyay via bind-users <<a target="_blank" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>> wrote:<br><br></blockquote></div><blockquote><div dir="ltr"><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10pt"><div>Hello, <br></div><div><br></div><div>I am observing different RPZ behavior for an IDN domain after upgrading from BIND 9.20.23 to 9.20.26 and would appreciate any guidance.<br></div><div><br></div><div>Environment:<br></div><div><br></div><div>BIND 9.20.23: Works as expected<br></div><div>BIND 9.20.26: Fails<br></div><div>The BIND configuration and RPZ configuration are identical on both versions.<br></div><div><br></div><div>The queried domain is an IDN. The domain itself is not present in the RPZ, yet BIND 9.20.26 logs an "RPZ QNAME rewrite failed" message for the query, while the same query is resolved successfully on BIND 9.20.23 using the same configuration. Below are the logs<br></div><div><br></div><div>24-Jul-2026 15:37:16.288 query-errors: debug 3: client @0x7fd386c93800 <client_IP>#41889 (xn--i1bn6adp9emg4dcbcajdeflxp1gua1n7bt10abief.xn--11b7cb3a6a.xn--h2brj9c): view internal: rpz QNAME rewrite xn--i1bn6adp9emg4dcbcajdeflxp1gua1n7bt10abief.xn--11b7cb3a6a.xn--h2brj9c stop on qresult in rpz_rewrite(): failure<br></div><div>24-Jul-2026 15:37:16.288 query-errors: info: client @0x7fd386c93800 <client_IP>#41889 (xn--i1bn6adp9emg4dcbcajdeflxp1gua1n7bt10abief.xn--11b7cb3a6a.xn--h2brj9c): view internal: query failed (failure) for xn--i1bn6adp9emg4dcbcajdeflxp1gua1n7bt10abief.xn--11b7cb3a6a.xn--h2brj9c/IN/A at query.c:7651<br></div><div>24-Jul-2026 15:37:16.288 query-errors: debug 4: fetch completed for xn--i1bn6adp9emg4dcbcajdeflxp1gua1n7bt10abief.xn--11b7cb3a6a.xn--h2brj9c/A in 0.042000: failure/deadlock found [domain:xn--i1bn6adp9emg4dcbcajdeflxp1gua1n7bt10abief.xn--11b7cb3a6a.xn--h2brj9c,referral:1,restart:2,qrysent:4,timeout:0,lame:0,quota:0,neterr:0,badresp:0,adberr:0,findfail:0,valfail:4]<br></div><div><br></div><div>If anyone has encountered this issue before or is aware of a workaround or solution, I would be grateful for your suggestions.<br></div><div><br></div><div>Regards,<br></div><div>Sachchidanand Upadhyay<br></div><div><br></div></div><br><span>-- </span><br><span>Visit <a target="_blank" href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list.</span><br></div></blockquote></div></div></blockquote></div><div><br></div></div><br></body></html>