Home / server / Questions / 514247
Accepted
Malvineous
Asked: 2013-06-08 13:51:16 +0800 CST

Tell BIND to not forward for domains used by DNS block list services

  • 772

How can I tell BIND to stop forwarding queries to my provider's DNS servers for a specific list of domains, but to forward for everything else?

I'm using BIND as an authorative nameserver for my domain. It also provides DNS resolution for other queries on the host, by forwarding them to my provider's DNS servers:

forward first;
forwarders {
    1.2.3.4;
    5.6.7.8;
};

However I am running SpamAssassin and my queries to various DNS blocklists are being rejected, since they are going through my provider's nameservers (along with many of my fellow customers) and reaching the limit for free queries originating from their IP addresses. Since I only have a small number of queries myself (maybe 5-10 a day) I would like to configure BIND so that it does NOT forward DNSBL queries to my provider's servers, but it DOES forward everything else.

This should allow me to continue to use DNS blocklists to spam check the small amount of e-mail I get, without having to turn off the forwarding/caching entirely.

How can I tell BIND not to forward just a handful of domains, but keep it forwarding everything else?

domain-name-system

2 Answers

  1. Try configuring zones for your blacklists, and configure them not to forward. Something like this should work. You will need one of these for each blacklist zone. 

    zone "blacklist.example.com" {
    type static-stub;
    recursion yes;
};

    You will also need to setup the root zone so recursion will work. You likely already have done this.

    • 2
  2. Best Answer

    Thanks to @BillThor I was able to come up with this entry which works with older (9.7.3) versions of BIND:

    zone "blacklist.example.com" {
    type forward;
    forwarders {};
};

    On my Debian machine I added it to /etc/bind/named.conf.local

    • 1