I've setup a caching DNS server with bind9 using a root-hints method (like this). It works as desired--but, our IPv6 traffic goes through a gateway outside of my country that makes Netflix think we're visiting from that other country, and this prevents my kids from watching their favorite shows. So I'm thinking that if I can prevent bind9 from returning any AAAA records for netflix.com, the clients will only attempt IPv4 connections to Netflix.

That is: how do I configure bind9 so that AAAA record look-ups for netflix.com are suppressed while valid A record results are returned for netflix.com?

I realize I can create a zone file with just the Netflix domain and have it contain all of the A records for netflix.com that I can find and no AAAA records. But I'm wondering if maybe the above is possible so I don't have to keep the A records in the zone file updated.

  • I don't quite see how this is a duplicate. The way I understand the other question, it appears to block a domain entirely, which is not what I want; I want to return valid A records for the domain just not AAAA records. – Ole Wolf Jan 17 '17 at 21:05
  • I marked this as a dupe of a RPZ Q&A before I realized that this was question was not for a business environment. If you have any further questions about how to implement such a RPZ rule, you should probably direct it at a more appropriately scoped Stack Exchange site. – Andrew B Jan 17 '17 at 21:10
  • 1
    Thanks. But, how do I actually do that? I can readily Google plenty of examples of RPZ snippets but I haven't been able to locate any that capture AAAA records specifically to do something about them while returning the A records as if nothing has happened. What should I write in the RPZ file in order to return a NODATA response for AAAA records only like you suggest? – Ole Wolf Jan 17 '17 at 21:22
  • Argh...you're right, NODATA anchors to the entire label and not to a specific record type. That feels like an oversight, I'll probably bug the standard authors if it hasn't been raised on a mailing list already. I apologize for the incorrect flagging, but I would go ahead and ask this question on Superuser due to this being focused on a home setting. – Andrew B Jan 17 '17 at 21:28
  • Indeed, not sure you can get BIND to do what you ask for. Something like superuser.com/a/1168140/241293 could do the trick, but that's not with BIND alone. – Håkan Lindqvist Jan 17 '17 at 22:00

As is indicated by the comments, bind may not be capable of this. However, I managed to solve the problem with a work-around:

Firstly, I added a second bind service listening on port 5353 with just the following configuration file:

acl mynetworks {
    (And a list with my various LAN networks such as;)

acl everyone {

options {
    directory "/var/cache/bind-ipv4limited";
    filter-aaaa-on-v4 yes;
    #dnssec-validation auto;
    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;
    dnssec-lookaside . trust-anchor dlv.isc.org.;
    recursion yes;
    allow-query { mynetworks; };

    forwarders {;;
    forward only;

    auth-nxdomain no;    # conform to RFC1035
    listen-on port 5353 { any; };

The key here is to use "filter-aaaa-on-v4 yes;" so it ignores AAAA requests.

Then in the original bind service, I added a zone for netflix.com that uses the above DNS service:

zone "netflix.com" {
    type forward;
    forward only;
    forwarders { port 5353;

It's an ugly hack, but it seems to work.


I know this is an old post, but (at least) in my version of bind (9.11 on Ubuntu 18.04) I discovered that you can use filter-aaaa-on-v4 combined with match-destinations in a view.

It still requires you to have bind listening on 2 ip adresses, but at least you don't need multiple instances. is the normal dns server. is the ipv6 blocking one.

My config looks kind of like this (partial):

options {
    listen-on port 53 {; };
    listen-on port 5353 {; };

view "ipv4only" {
  match-destinations {; };
  filter-aaaa-on-v4 yes;

view "normal" {
  match-clients {; };
  zone "netflix.com" {
    type forward;
    forward only;
    forwarders { port 5353; };

That makes bind do a forward lookup to itself on another ip, when the domain matches netflix.com.

This eliminates the need for two instances, but sadly requires 2 internal ip adresses. It would be nice if we also could specify a port number in "match-destinations".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.