Skip to main content
A response policy zone (RPZ) is a blocklist in the form of a DNS zone, the format BIND, Unbound, Knot Resolver and PowerDNS Recursor share. Threat-intelligence providers (and other resolvers) publish them. DNZ can subscribe to them, and serve its own blocklists as one. Superadmins manage them under DNS → Filtering → Server-wide → Response policy zones, with dnz filter rpz, or the API. RPZ applies to names outside local zones, for every client.

​
Order of decisions

  1. Local zones are answered as always.
  2. An allow rule or allow entry that applies to the client lets the name through: RPZ is skipped too.
  3. RPZ zones, top to bottom: the first zone with a matching rule decides. Within a zone, a client-address rule comes before a name rule, and an exact name before a wildcard.
  4. Blocklists, then safe search (see Filtering).
  5. Forwarding. Forwarded (and cached) answers are then checked against the zones’ answer address rules.
A zone’s passthru answer goes straight to forwarding, without the blocklists.

​
Subscribe to a zone

1

Ask the provider for access

Ask the provider to allow DNZ’s address, and to give you a TSIG key if they use one.
2

Add the zone

Open DNS → Filtering, pick the Server-wide scope, and add a zone under Response policy zones: its name, the Source (zone transfer or URL), the primaries or the zone file URL, and the TSIG key if there is one.
3

Try it as count only

Set its policy to Count only first, watch the hits on real traffic, then switch to The zone’s actions.
Zones are checked again every hour (refresh_secs, 60 seconds to 7 days), and ⟳ fetches one now. If a fetch fails, the previous rules stay in use and the error is shown. Zones are checked in the order shown; the arrows change it.

​
Policy

Each zone can override its own actions:

​
What DNZ understands

The owner name of each record (below the zone’s name) is the trigger; its records are the action. IPv6 addresses are written word by word in reverse, with zz for :: (48.zz.db8.2001.rpz-ip is 2001:db8::/48). NSDNAME and NSIP triggers aren’t supported: those rules are counted as skipped. For example, a small zone file served over a URL:
threats.rpz

​
Check and monitor

  • Answers changed by RPZ appear in the query log as RPZ, and under the Blocked filter.
  • Test a domain on the Filtering page shows which zone and rule would answer a name:
  • Each zone shows its rule count, its hits, its serial and the last error.
  • Every change is recorded in the audit log (rpz.*).

​
Serve DNZ’s blocklists as RPZ

Turn on Serve the blocklists as an RPZ zone (default name rpz.dnz) and other resolvers can transfer DNZ’s server-wide lists and rules:
  • each blocked domain becomes NXDOMAIN for the name and the names under it,
  • each allowed one becomes passthru.
Lists and rules limited to some clients or a schedule, and division lists, stay out. The SOA serial changes whenever the lists do, and resolvers check it every 5 minutes (the SOA refresh).
Transfers follow the same access rules as zone replication: add the resolver under DNS → Replication → Secondary servers, by its address without TSIG, or with a TSIG key. Then set up the resolver. The Filtering page fills these in, with copy buttons, for the address you enter. Here DNZ is reachable at 192.0.2.10:
named.conf
If DNZ answers DNS on a port other than 53, add it to the address on the resolver (192.0.2.10 port 1053 in BIND, 192.0.2.10@1053 in Unbound, 192.0.2.10:1053 in PowerDNS).