1

I have a Bind9 instance acting as a caching (forwarding) name server for a group of mail servers. Basically it queries a few specific upstream nameservers only when the domains arent in the cache.

This name server is not authoritative for any domain (here are no zones).

I would like to use this Bind instance to 'blacklist' a few domains, similar to a DNSBL; I'd like to simply return 'NXDOMAIN' for domain 'bad.example.com'. How can I do this?

I don't need any complex rbld or similar, it's just going to be for a few domains that I don't want anything to do with.

Relevant named.conf options:

options { 
        forwarders {
                8.8.8.8;
                1.2.3.4;
                5.6.7.8
        };
    };

2 Answers 2

1

You could add the blacklisted domains in named.conf as a zone directive.

zone "bad.example.com" { type master; file "bad_domains"; };

then create bad_domains zonedata with only a SOA record in it.

Regards, jgr

2

I know only one method that BIND return NXDOMAIN:

zone "bad.example.com" {
        type slave;
        masters { 127.0.0.1; };
};

I prefer:

zone "bad.example.com" {
        type master;
        file "/etc/bind/db.bad.example.com";
};


;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
@       IN      A       127.0.0.1
*       IN      A       127.0.0.1

or without *

1
  • 1
    Bind returns NOERROR for bad.example.com in this case. If I remove everything but the SOA record from the data file, it returns SERVFAIL. Is there a way to get it to return NXDOMAIN?
    – mikewaters
    Dec 8, 2010 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .