// Fragments of named.conf for RPZ DNS blocks.

// Available from https://www.dns.cam.ac.uk/code/nsconfig/rpz.named.conf

// Overview documentation at https://www.dns.cam.ac.uk/servers/stealth.html

options {

    // your other options

	...

    // DNS RPZ blocking policy.
    //
    // This is the configuration we are using on the central recursive DNS
    // servers.
    //
    // The order of zones matters (as described in the comments). There is a
    // place-holder comment for zones that only list forward domains, which
    // can be handled faster (because of the `qname-wait-recurse no` option).
    // The `block.arpa.cam.ac.uk` and `drop.rpz.spamhaus.org` zones list IP
    // addresses, so the resolver has to get the response before it can work
    // out if it should be blocked.
    //
    // The `policy cname ...` parts cause a redirect to the "Site blocked"
    // web page on www.dns.cam.ac.uk. The CNAME target in this configuration
    // tells the machinery on the web server which policy caused the block,
    // so it can make the "site blocked" page more informative. You can
    // replace them with pointers to your own web server if you wish.
    //
    // You can add your own policy zones to this configuration, though you
    // should either set up your own target web server, or use a blocking
    // policy such as `nodata` which does not need one. See
    // https://dnsrpz.info/ for details.

	response-policy {
		# passthru overrides any other triggers
		zone "passthru.arpa.cam.ac.uk"
			policy passthru;
		# qname and rpz-client-ip triggers only
		# (avoids unnecessary recursion)
		zone "nxdomain.arpa.cam.ac.uk"
			policy nxdomain;
		# any RPZ triggers
		zone "block.arpa.cam.ac.uk"
			policy cname "cam-csirt.block.dns.cam.ac.uk";
		zone "drop.rpz.spamhaus.org"
			policy cname "spamhaus-drop.block.dns.cam.ac.uk";
	}
		break-dnssec yes
		max-policy-ttl 300
		qname-wait-recurse no
	;

    // your other options

	...

};

// your other options

...

// In order for the `response-policy` configuration to work, the server
// must be a (stealth) secondary for the policy zones.

// The CSIRT policy zones should be slaved from our authoritative DNS
// servers. They are included in catz.arpa.cam.ac.uk, so you don't need to
// configure them explicitly if you are using the catalog zone setup.

zone "block.arpa.cam.ac.uk" {
	type slave;
	file "db.cam-block";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "nxdomain.arpa.cam.ac.uk" {
	type slave;
	file "db.cam-nxdomain";
	masters { 131.111.8.37; 131.111.12.37; };
};

zone "passthru.arpa.cam.ac.uk" {
	type slave;
	file "db.cam-passthru";
	masters { 131.111.8.37; 131.111.12.37; };
};

// Third-party zones should (currently) be slaved from the central
// recursive servers. This recommendation may change.

// The Spamhaus "don't route or peer" list is free; it blocks the worst of
// the worst according to their assessment.

zone "drop.rpz.spamhaus.org" {
	type slave;
	file "db.spamhaus-drop";
	masters { 131.111.8.42; 131.111.12.20; };
};

// your other options

...

//  End
