I have a Bind9 instance acting as a caching (forwarding) name server for a group of mail servers. Basically it queries a few specific upstream nameservers only when the domains arent in the cache.

This name server is not authoritative for any domain (here are no zones).

I would like to use this Bind instance to 'blacklist' a few domains, similar to a DNSBL; I'd like to simply return 'NXDOMAIN' for domain 'bad.example.com'. How can I do this?

I don't need any complex rbld or similar, it's just going to be for a few domains that I don't want anything to do with.

Relevant named.conf options:

options { 
        forwarders {

You could add the blacklisted domains in named.conf as a zone directive.

zone "bad.example.com" { type master; file "bad_domains"; };

then create bad_domains zonedata with only a SOA record in it.

Regards, jgr

| improve this answer | |

I know only one method that BIND return NXDOMAIN:

zone "bad.example.com" {
        type slave;
        masters {; };

I prefer:

zone "bad.example.com" {
        type master;
        file "/etc/bind/db.bad.example.com";

; BIND data file for local loopback interface
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS      localhost.
@       IN      A
*       IN      A

or without *

| improve this answer | |
  • 1
    Bind returns NOERROR for bad.example.com in this case. If I remove everything but the SOA record from the data file, it returns SERVFAIL. Is there a way to get it to return NXDOMAIN? – mikewaters Dec 8 '10 at 19:13

Your Answer

