In my cloud environment, I have a bind9 server functioning as a proxy for all outgoing DNS queries generated in the environment. I'm currently trying to configure Bind to perform the following filtering as part of its name resolution flow -
- Allow recursive resolution for some zones (let's say,
aws.com
andgcp.com
) - Do not allow queries to any other zones, including those holding the CNAMEs for the previously mentioned domains (for example, if
A.aws.com
has a CNAME tocustom.service.digitalocean.com
, allow the recursive resolution but do not allow any client requests to*.service.digitalocean.com
As far as I could understand, the way to do this is by using RPZs (probably allowing a zone with the recursive-only
flag, and denying all other resolutions to the same zone). However, I could not get a working configuration or find any samples.
EDIT: I have not managed to make RPZs work on forwarded zones (it seems to work on master/slave zones only).
Any ideas? Alternative ways to achieve the same functionality (without RPZs) are equally acceptable for me...