Re: Response Policy Zone: disabling "leaking" of lookups

2020-09-03 Thread Fred Morris
Carl Byington wrote: > On Wed, 2020-09-02 at 17:47 -0700, Fred Morris wrote: > > how do I disable the (useless) resolution directed at upstream > > servers? > > Isn't that just "qname-wait-recurse no;" > You are correct! I got confused and the doc didn't help. The logic is tri-state: *Default*

Re: [DNSfirewalls] Response Policy Zone: disabling "leaking" of lookups

2020-09-03 Thread pvm_job via bind-users
It is a well known behaviour.  This is the way how your DNS client works (not DNS server). Get rid of the search list or block requests to the domains in the search lists by RPZ (e.g. if it is pushed by ISP).   BR, Vadim >Четверг, 3 сентября 2020, 19:04 +03:00 от Fred Morris : >  >It comes to

Re: Response Policy Zone: disabling "leaking" of lookups

2020-09-02 Thread Carl Byington via bind-users
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Wed, 2020-09-02 at 17:47 -0700, Fred Morris wrote: > how do I disable the (useless) resolution directed at upstream > servers? Isn't that just "qname-wait-recurse no;" -BEGIN PGP SIGNATURE-

Response Policy Zone: disabling "leaking" of lookups

2020-09-02 Thread Fred Morris
It comes to my attention that when an unresolvable query occurs, it gets forwarded to the authoritative zone regardless of anything I can set in named.conf. Closest I can come is qname-wait-recurse which has the /opposite/ effect sort of, namely waiting for recursion to complete. If I have