Home / user-563569

thomas1985's questions

Martin Hope
thomas1985
Asked: 2020-03-11 14:31:25 +0800 CST
  • 1

The goal is to have a local DNS server with the following specifics:

  • split DNS setup that resolves a FQDN (e.g. localdomain.com) to a local IP instead of the external IP
  • use a RPZ (response policy zone) to answer certain DNS lookups with a NXDOMAIN response (preferably without doing a forward/lookup in advance)
  • allow forward lookups for all other DNS requests

The system on which this runs is a Synology NAS with BIND 9.9.9-P8 (which apparently doesn't support the option "qname-wait-recurse" yet to eliminate lookups before a RPZ NXDOMAIN answer can be given, which would be ideal).

This is the current named.conf:

options {
    interface-interval 1;
    listen-on-v6 {
        "any";
    };
    recursive-clients 1000;
    tcp-clients 100;
    version "DNSServer";
    allow-recursion {
        192.168.1.0/24;
    };
    check-names master ignore;
    check-names slave ignore;
    check-names response ignore;
    max-cache-size 10485760;
    max-cache-ttl 86400;
    response-policy {
        zone "blocked-domains.rpz";
    };
    forward only;
    forwarders {
        84.200.69.80;
        84.200.70.40;
    };
    max-journal-size 1024;
    min-refresh-time 1;
    min-retry-time 1;
};
controls {
    inet 127.0.0.1 port 953 allow {
        127.0.0.1/32;
    } keys {
        "rndc-key";
    };
};
logging {
    channel "default-log" {
        syslog "user";
        severity Info;
    };
    category "default" {
        "default-log";
    };
    category "security" {
        "default-log";
    };
    category "resolver" {
        "default-log";
    };
    category "queries" {
        "default-log";
    };
    category "xfer-in" {
        "default-log";
    };
    category "xfer-out" {
        "default-log";
    };
    category "general" {
        "default-log";
    };
};
key "rndc-key" {
    algorithm "hmac-md5";
    secret "**redacted**";
};
zone "localdomain.com" {
    type master;
    file "/etc/zone/master/localdomain.com";
    allow-query {
        192.168.1.0/24;
    };
    allow-transfer {
        "none";
    };
    allow-update {
        "none";
    };
};
zone "1.168.192.in-addr.arpa" {
    type master;
    file "/etc/zone/master/1.168.192.in-addr.arpa";
    allow-query {
        192.168.1.0/24;
    };
    allow-transfer {
        "none";
    };
    allow-update {
        "none";
    };
};
zone "blocked-domains.rpz" {
    type master;
    file "/etc/zone/master/blocked-domains.rpz";
    allow-query {
        "none";
    };
    allow-transfer {
        "none";
    };
    allow-update {
        "none";
    };
};

This is /etc/zone/master/localdomain.com:

$ORIGIN localdomain.com.
$TTL 86400
localdomain.com. IN SOA ns.localdomain.com. hostmaster.localdomain.com. (2020031000 43200 180 1209600 10800)
ds.localdomain.com. 86400   A   192.168.1.10
localdomain.com.            NS  ns.localdomain.com.
ns.localdomain.com. 86400   A   192.168.1.10

This is /etc/zone/master/1.168.192.in-addr.arpa:

$ORIGIN 1.168.192.in-addr.arpa.
$TTL 86400
1.168.192.in-addr.arpa. IN SOA ns.1.168.192.in-addr.arpa. hostmaster.1.168.192.in-addr.arpa. (2020031000 43200 180 1209600 10800)
10.1.168.192.in-addr.arpa.  86400   PTR ds.localdomain.com.
1.168.192.in-addr.arpa.     86400   NS  ns.localdomain.com.

This is /etc/zone/master/blocked-domains.rpz:

$TTL 86400
@           86400   IN  SOA LOCALHOST.  hostmaster.blocked-domains.rpz. (2020031008 43200 180 2592000 10800)
@           86400   IN  NS  LOCALHOST.

reports.crashlytics.com     CNAME .
settings.crashlytics.com    CNAME .

But when a client performs a DNS query the log shows double or quadruple queries (for A and AAAA records) before the RPZ NXDOMAIN response is given.

Sample log double:

2020/03/10 21:55:11.430 rpz     query   client 192.168.1.22#45129 (reports.crashlytics.com): rpz QNAME NXDOMAIN rewrite reports.crashlytics.com via reports.crashlytics.com.blocked-domains.rpz
2020/03/10 21:55:11.430 queries query   client 192.168.1.22#45129 (reports.crashlytics.com): query: reports.crashlytics.com IN A + (192.168.1.10)
2020/03/10 21:55:11.425 rpz     query   client 192.168.1.22#41862 (reports.crashlytics.com): rpz QNAME NXDOMAIN rewrite reports.crashlytics.com via reports.crashlytics.com.blocked-domains.rpz
2020/03/10 21:55:11.406 queries query   client 192.168.1.22#41862 (reports.crashlytics.com): query: reports.crashlytics.com IN A + (192.168.1.10)

Sample log quadrupel:

2020/03/10 21:49:19.242 rpz     query   client 192.168.1.41#54615 (settings.crashlytics.com): rpz QNAME NXDOMAIN rewrite settings.crashlytics.com via settings.crashlytics.com.blocked-domains.rpz
2020/03/10 21:49:19.242 queries query   client 192.168.1.41#54615 (settings.crashlytics.com): query: settings.crashlytics.com IN A + (192.168.1.10)
2020/03/10 21:49:19.239 rpz     query   client 192.168.1.41#49403 (settings.crashlytics.com): rpz QNAME NXDOMAIN rewrite settings.crashlytics.com via settings.crashlytics.com.blocked-domains.rpz
2020/03/10 21:49:19.239 queries query   client 192.168.1.41#49403 (settings.crashlytics.com): query: settings.crashlytics.com IN AAAA + (192.168.1.10)
2020/03/10 21:49:19.236 rpz     query   client 192.168.1.41#49374 (settings.crashlytics.com): rpz QNAME NXDOMAIN rewrite settings.crashlytics.com via settings.crashlytics.com.blocked-domains.rpz
2020/03/10 21:49:19.236 queries query   client 192.168.1.41#49374 (settings.crashlytics.com): query: settings.crashlytics.com IN A + (192.168.1.10)
2020/03/10 21:49:19.230 rpz     query   client 192.168.1.41#35402 (settings.crashlytics.com): rpz QNAME NXDOMAIN rewrite settings.crashlytics.com via settings.crashlytics.com.blocked-domains.rpz
2020/03/10 21:49:19.212 queries query   client 192.168.1.41#35402 (settings.crashlytics.com): query: settings.crashlytics.com IN AAAA + (192.168.1.10)

Can someone explain why the double queries are happening and if there's a way to prevent it?

domain-name-system logging bind synology rpz