Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Bind9 instance acting as a caching (forwarding) name server for a group of mail servers. Basically it queries a few specific upstream nameservers only when the domains arent in the cache.

This name server is not authoritative for any domain (here are no zones).

I would like to use this Bind instance to 'blacklist' a few domains, similar to a DNSBL; I'd like to simply return 'NXDOMAIN' for domain 'bad.example.com'. How can I do this?

I don't need any complex rbld or similar, it's just going to be for a few domains that I don't want anything to do with.

Relevant named.conf options:

options { 
        forwarders {
                8.8.8.8;
                1.2.3.4;
                5.6.7.8
        };
    };
share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

You could add the blacklisted domains in named.conf as a zone directive.

zone "bad.example.com" { type master; file "bad_domains"; };

then create bad_domains zonedata with only a SOA record in it.

Regards, jgr

share|improve this answer
add comment

I know only one method that BIND return NXDOMAIN:

zone "bad.example.com" {
        type slave;
        masters { 127.0.0.1; };
};

I prefer:

zone "bad.example.com" {
        type master;
        file "/etc/bind/db.bad.example.com";
};


;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
@       IN      A       127.0.0.1
*       IN      A       127.0.0.1

or without *

share|improve this answer
1  
Bind returns NOERROR for bad.example.com in this case. If I remove everything but the SOA record from the data file, it returns SERVFAIL. Is there a way to get it to return NXDOMAIN? –  mikewaters Dec 8 '10 at 19:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.