Why does nslookup not return what I am expecting from my bind server? (RPZ configured)

Question

Prior to this question I was looking for some help in finding a way to return a different response to querying clients based on their IP Address. The question was answered here: How can I selectively override some A records on a Bind DNS Server?

I have followed what the accepted answer was, and now running into issues.

When I run:

nslookup faq.test.com 

I expect this:

root@dev:/etc/bind# nslookup vaultofsatoshi.com
Server:     172.16.225.132
Address:    172.16.225.132#53

Non-authoritative answer:
Name:   faq.test.com
Address: 192.168.1.1

However, I am getting this:

root@dev:/etc/bind# nslookup faq.test.com
Server:     172.16.225.132
Address:    172.16.225.132#53

** server can't find faq.test.com: NXDOMAIN

I should mention, querying google.com or any other website works and returns everything fine, it is just the ones that I override that it fails. I've included my configuration files below, any help would be appreciated.

/etc/bind/named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

/etc/bind/named.conf.options

options {
    directory "/var/cache/bind";

    forwarders {
        8.8.8.8;
        8.8.4.4;
    };

    response-policy { 
        zone "development-overrides"; 
    };

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
    allow-query { trusted; };
    allow-recursion { trusted; };
    recursion yes;
    dnssec-enable no;
    dnssec-validation no;
};

/etc/bind/named.conf.local

include "/etc/bind/rndc.key";

acl "trusted" {
    172.16.225.132;
    127.0.0.1;
};

include "/etc/bind/zones.override";

logging {
    channel bind_log {
        file "/var/log/named/named.log" versions 5 size 30m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };
    category default { bind_log; };
    category queries { bind_log; };
};

/etc/bind/named.conf.default-zones

// prime the server with knowledge of the root servers
zone "." {
    type hint;
    file "/etc/bind/db.root";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
    type master;
    file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
    type master;
    file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
    type master;
    file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
    type master;
    file "/etc/bind/db.255";
};

/etc/bind/development-overrides

$TTL 1H
@                       SOA LOCALHOST. test.com (1 1h 15m 30d 2h)
                        NS  LOCALHOST.

support.test.com     A   192.168.1.1
faq.test.com         A   192.168.1.1

; do not rewrite (PASSTHRU) OK.DOMAIN.COM
*               A   rpz-passthru.

Answer 1

The last line in the RPZ zone does not look syntactically valid.

The syntax for an RPZ zone is the same as for regular zones, it only has special semantics for RPZ.

With that in mind it's clear that an A record can't possibly have rpz-passthru. as it's value. An A record can only ever have an IPv4 address as its value.

If you look at the RPZ documentation you will find that the special RPZ directives (like rpz-passthru.) use the CNAME record type.

named-checkconf -zj and/or reading the logs is generally helpful. I would assume that, when using the zone data from the question, the RPZ zone will fail to load and there should be errors about that (I would expect an error about "bad dotted quad" or something along those lines).

As a separate note, I don't believe that last line is really needed, it appears to just (try to) explicitly define what the default behavior would have been.