From Newsgroup: comp.protocols.dns.bind
This is a multi-part message in MIME format. --------------5E034BDF2770A610DF24D1D3
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
It comes to my attention that when an unresolvable query occurs, it gets forwarded to the authoritative zone regardless of anything I can set in named.conf. Closest I can come is qname-wait-recurse which has the
/opposite/ effect sort of, namely waiting for recursion to complete. If
I have something in an RPZ, I want it to accept that; period, full stop,
no outwardly visible effects.
Ironically the text surrounding this option in the ARM is to the effect
that "... not resolving the requested name can leak the fact that
response policy rewriting is in use..." and leaking the fact that it is
in use by not leaking the query in the first place is what I'm trying to achieve: how do I disable the (useless) resolution directed at upstream servers?
Here is a use case:
1. A search list is in place for example.com. This means that if
"foo.bar" fails to resolve then "foo.bar.example.com" will be tried,
followed by "foo.bar.com".
2. In addition to the foregoing a rule is placed in the RPZ that
"com.example.com" and "*.com.example.com" are NXDOMAIN.
3. An additional rule is present in the RPZ that
"my-outhouse-example.com" is NXDOMAIN.
In this case:
* "my-outhouse-example.com.example.com" will return NXDOMAIN (it does!)
* There should be /no/ upstream (pointless) query for
my-outhouse-example.com.example.com. (oops!)
Let's stop the leaks.
--
Fred Morris
--------------5E034BDF2770A610DF24D1D3
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>It comes to my attention that when an unresolvable query occurs,
it gets forwarded to the authoritative zone regardless of anything
I can set in named.conf. Closest I can come is qname-wait-recurse
which has the <i>opposite</i> effect sort of, namely waiting for
recursion to complete. If I have something in an RPZ, I want it to
accept that; period, full stop, no outwardly visible effects.</p>
<p>Ironically the text surrounding this option in the ARM is to the
effect that "... not resolving the requested name can leak the
fact that response policy rewriting is in use..." and leaking the
fact that it is in use by not leaking the query in the first place
is what I'm trying to achieve: how do I disable the (useless)
resolution directed at upstream servers?</p>
<p>Here is a use case:</p>
<ol>
<li>A search list is in place for example.com. This means that if
"foo.bar" fails to resolve then "foo.bar.example.com" will be
tried, followed by "foo.bar.com".</li>
<li>In addition to the foregoing a rule is placed in the RPZ that
"com.example.com" and "*.com.example.com" are NXDOMAIN.</li>
<li>An additional rule is present in the RPZ that
"my-outhouse-example.com" is NXDOMAIN.<br>
</li>
</ol>
<p>In this case:</p>
<ul>
<li>"my-outhouse-example.com.example.com" will return NXDOMAIN (it
does!)<br>
</li>
<li>There should be <i>no</i> upstream (pointless) query for
my-outhouse-example.com.example.com. (oops!)<br>
</li>
</ul>
<p>Let's stop the leaks.</p>
<p>--</p>
<p>Fred Morris</p>
<p><br>
</p>
</body>
</html>
--------------5E034BDF2770A610DF24D1D3--
--- Synchronet 3.21d-Linux NewsLink 1.2