The action describes what action should be taken if the policy needs to be applied. The trigger describes when the policy should be applied. Something that Unbound is already capable of doing for its auth-zone feature.Įach policy in the policy zone consist of a trigger and an action. This makes it possible to easily consume and keep them to up-to-date by using DNS zone transfers. RPZ policies are formatted in DNS zone files. There is, however, a policy format that will work on different resolver implementations, and that has capabilities to be directly transferred and loaded from external sources: Response Policy Zones (RPZ). You then have to keep this list up-to-date, for example using unbound-control. You will have to fetch the external policies in the offered format, and reformat it in such a way that Unbound will understand it. Using the Unbound specific configuration also makes it challenging to consume policies from external sources.

If you operate resolvers from multiple vendors you have to maintain your policies for multiple configurations, which all will have their own syntax. Although these options are heavily used, they are Unbound specific. Unbound also contains the respip module which makes it possible to rewrite answers containing certain IP addresses. This makes it possible to give a custom answer back for certain domain names. Unbound, for a long time already, has support for local-zones and local-data.

Rcode nxdomain