I have a Bind9 instance acting as a caching (forwarding) name server for a group of mail servers. Basically it queries a few specific upstream nameservers only when the domains arent in the cache.

This name server is not authoritative for any domain (here are no zones).

I would like to use this Bind instance to 'blacklist' a few domains, similar to a DNSBL; I'd like to simply return 'NXDOMAIN' for domain 'bad.example.com'. How can I do this?

I don't need any complex rbld or similar, it's just going to be for a few domains that I don't want anything to do with.

Relevant named.conf options:

options { 
        forwarders {

You could add the blacklisted domains in named.conf as a zone directive.

zone "bad.example.com" { type master; file "bad_domains"; };

then create bad_domains zonedata with only a SOA record in it.

Regards, jgr

| improve this answer | |

I know only one method that BIND return NXDOMAIN:

zone "bad.example.com" {
        type slave;
        masters {; };

I prefer:

zone "bad.example.com" {
        type master;
        file "/etc/bind/db.bad.example.com";

; BIND data file for local loopback interface
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS      localhost.
@       IN      A
*       IN      A

or without *

| improve this answer | |
  • 1
    Bind returns NOERROR for bad.example.com in this case. If I remove everything but the SOA record from the data file, it returns SERVFAIL. Is there a way to get it to return NXDOMAIN? – mikewaters Dec 8 '10 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.