Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Prior to this question I was looking for some help in finding a way to return a different response to querying clients based on their IP Address. The question was answered here: How can I selectively override some A records on a Bind DNS Server?

I have followed what the accepted answer was, and now running into issues.

When I run:


I expect this:

root@dev:/etc/bind# nslookup

Non-authoritative answer:

However, I am getting this:

root@dev:/etc/bind# nslookup

** server can't find NXDOMAIN

I should mention, querying or any other website works and returns everything fine, it is just the ones that I override that it fails. I've included my configuration files below, any help would be appreciated.


include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";


options {
    directory "/var/cache/bind";

    forwarders {;;

    response-policy { 
        zone "development-overrides"; 

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
    allow-query { trusted; };
    allow-recursion { trusted; };
    recursion yes;
    dnssec-enable no;
    dnssec-validation no;


include "/etc/bind/rndc.key";

acl "trusted" {;;

include "/etc/bind/zones.override";

logging {
    channel bind_log {
        file "/var/log/named/named.log" versions 5 size 30m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    category default { bind_log; };
    category queries { bind_log; };


// prime the server with knowledge of the root servers
zone "." {
    type hint;
    file "/etc/bind/db.root";

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
    type master;
    file "/etc/bind/db.local";

zone "" {
    type master;
    file "/etc/bind/db.127";

zone "" {
    type master;
    file "/etc/bind/db.0";

zone "" {
    type master;
    file "/etc/bind/db.255";


@                       SOA LOCALHOST. (1 1h 15m 30d 2h)
                        NS  LOCALHOST.     A         A

; do not rewrite (PASSTHRU) OK.DOMAIN.COM
*               A   rpz-passthru.
share|improve this question
up vote 1 down vote accepted

The last line in the RPZ zone does not look syntactically valid.

The syntax for an RPZ zone is the same as for regular zones, it only has special semantics for RPZ.

With that in mind it's clear that an A record can't possibly have rpz-passthru. as it's value. An A record can only ever have an IPv4 address as its value.

If you look at the RPZ documentation you will find that the special RPZ directives (like rpz-passthru.) use the CNAME record type.

named-checkconf -zj and/or reading the logs is generally helpful. I would assume that, when using the zone data from the question, the RPZ zone will fail to load and there should be errors about that (I would expect an error about "bad dotted quad" or something along those lines).

As a separate note, I don't believe that last line is really needed, it appears to just (try to) explicitly define what the default behavior would have been.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.