1

I have setup a BIND9 server on host so that I can block malicious websites on my network. I have used OZNU's DNS Zone Blacklist tool to generate the desired blacklist. Overall, it works really well. However, I encountered some issues with some legitimate domains, such as www.austrian.com. The DNS will resolve to a 0.0.0.0 ip.

Using dig @localhost www.austrian.com results into the following output:

; <<>> DiG 9.11.5-P4-5.1-Debian <<>> @localhost www.austrian.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23905
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 935fe58262a7e3cfd1aa5d1b5d507537d4ced7fb2768fc25 (good)
;; QUESTION SECTION:
;www.austrian.com.              IN      A

;; ANSWER SECTION:
www.austrian.com.       61      IN      CNAME   www.austrian.com.edgekey.net.
www.austrian.com.edgekey.net. 4904 IN   CNAME   e7818.dsca.akamaiedge.net.
e7818.dsca.akamaiedge.net. 864000 IN    A       0.0.0.0

;; AUTHORITY SECTION:
akamaiedge.net.         864000  IN      NS      ns0.example.net.

;; Query time: 49 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Aug 11 22:06:15 CEST 2019
;; MSG SIZE  rcvd: 193

The above output seems to be the null.zone.file file. I have tried whitelisting the domain in the custom.whitelist.json, but without luck. I have other whitelisted domains which do work. Any ideas?

Thanks.

Edit: named.conf.options:

options {

        querylog no;
        directory "/var/cache/bind";
        listen-on { any; };
        auth-nxdomain no;    # conform to RFC1035
        recursion yes;                 # enables resursive queries
        allow-query { any; };

        forwarders {
                1.1.1.1;
                8.8.4.4;
        };
        dnssec-validation auto;
};

logging {
  ...
};
3
  • show us your bind config and zone file – djdomi Aug 11 '19 at 20:20
  • Look at your custom blacklist. – Michael Hampton Aug 11 '19 at 20:25
  • @MichaelHampton always the simplest answer, but not straight-forward :D – Comforse Aug 11 '19 at 20:35
0

SOLUTION:

It appeared that my custom.blacklist.json file had the following two entries:

akamaiedge.net
akamaitechnologies.net

While it may not be obvious straight away, www.austrian.com uses both of the above domains. The akamaiedge.net is in the dig response in my original question, while the reverse DNS for www.austrian.com is a subdomain of akamaitechnologies.net.

Removing the two entries from the custom.blacklist.json solved the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.