Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I work in Linux environment and I have a specific setup which requires me to have a DNS server which would only provide answers to queries which resolve to IPs which are whitelisted. This DNS will be accessed from internal machines only.

For example if it is provided with the following whitelist:

  • 1.1.1.1
  • 2.2.2.2

And domain foo.com resolves to 1.1.1.1 and domain bar.com resolves to 3.3.3.3, then it should provide a legitimate answer only for foo.com. For bar.com it should return "not found" or some other error.

I've read about Bind9's feature called Response Policy Zones (RPZ), but it seems it is only capable of blacklisting certain IPs.

share|improve this question
I'm assuming you're not authoritative for either foo.com or bar.com and hence you can't just add zones for them and disallow recursion because the owners of these domains could change their responses at any time. Is this correct? – Ladadadada Nov 14 '12 at 12:13
@Ladadadada you are correct. In fact there are a few thousand domains which need to resolve to the whitelisted IPs. – rocku Nov 14 '12 at 12:21
It may be easier for us if you ell us what you are trying to achieve with this. – Iain♦ Nov 14 '12 at 12:25
Actually I need this to setup a HTTP reverse proxy cluster which would only handle whitelisted backends. I cannot base this on domain names because the list changes very often. IPs do not. – rocku Nov 14 '12 at 13:44

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.