BIND: Response Policy Zones(RPZ) aka DNS Firewall

Updated: Sep 23, 2026

 
mkdir /var/named/zones/rpz
cd /var/named/zones/rpz

adware.rpz.internal
blacklist.rpz.internal
fakenews.rpz.internal
gambling.rpz.internal
porn.rpz.internal
social.rpz.internal
whitelist.rpz.internal

chown -Rf bind:bind /var/named

vim /etc/named.conf
 

 
// vim: set filetype=named :

include "/etc/named_keys.conf";


acl "net-internal-acl" { 10.0.0.0/8; 127.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
acl "host-nameserver-acl" { 10.0.0.2; 10.0.0.3; 127.0.0.1; };

acl "admin-key-acl" { key srv-rndc-key; key server1.example.net; key server2.example.net; };

remote-servers "host-nameserver-slaves" { 10.0.0.3; };
server 10.0.0.2 { keys { server1.example.net; }; };

controls { inet * port 953 allow { net-internal-acl; } 
	keys { 
		"srv-rndc-key"; 
		"server1.example.net"; 
		"server2.example.net"; 
		}; 
	};
statistics-channels { inet * port 9053 allow { net-internal-acl; }; };

options {
	server-id hostname;
	version "No version infomation available";
	listen-on port 53 { any; };
	directory "/var/named";
	pid-file "/var/run/named/pid";

	dnssec-validation auto;
	managed-keys-directory "dnssec";
	validate-except { internal; 10.in-addr.arpa; };

	dnssec-policy none;
	key-directory "dnssec";

	max-records-per-type 100;
	max-types-per-name 100;

	qname-minimization relaxed;

	minimal-any yes;
	minimal-responses no-auth-recursive;

	rate-limit {
		log-only yes;
	};

	recursion yes;
	allow-recursion { net-internal-acl; };
	recursive-clients 1000;

	empty-zones-enable no;

	allow-query { any; };
	allow-notify { host-nameserver-acl; };
	allow-update-forwarding { host-nameserver-acl; };
	allow-transfer { host-nameserver-acl; };
	allow-update { admin-key-acl; };

	dump-file "stats/named_dump.txt";
	zone-statistics full;
	statistics-file "stats/named_stats.txt";
	memstatistics yes;
	memstatistics-file "stats/named_memstats.txt";

	querylog no;
	responselog no;

	dnstap { all; };
	dnstap-output file "stats/dns.tap" size 100M versions 10 suffix timestamp;

	check-names master warn;
	check-names slave ignore;

	notify master-only;
	also-notify { host-nameserver-slaves; };

	allow-new-zones yes;
	new-zones-directory "zones";
	masterfile-format text;
	masterfile-style full;
	serial-update-method date;

	response-policy {
		zone "whitelist.rpz.internal";
		zone "blacklist.rpz.internal";
		zone "adware.rpz.internal";
		zone "porn.rpz.internal";
		zone "gambling.rpz.internal";
		zone "fakenews.rpz.internal";
//		zone "social.rpz.internal";
	};

};


logging {
	channel default {
		file "/var/named/logs/named.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
		severity dynamic;
	};
	channel "query" {
		file "/var/named/logs/query.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};
	channel "rpz" {
		file "/var/named/logs/rpz.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};
	channel "transfer" {
		file "/var/named/logs/transfer.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};
	channel "update" {
		file "/var/named/logs/update.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};


	category default { default; };

	category queries { query; };
	category query-errors { query; };
	category serve-stale { query; };
	category responses {query;};

	category lame-servers {null;};

	category resolver {rpz;};
	category rpz {rpz;};
	category rpz-passthru {rpz;};

	category notify { transfer; };
	category zoneload { transfer; };
	category xfer-in { transfer; };
	category xfer-out { transfer; };

	category update { update; };
	category update-security { update; };

};

zone "." { type slave; file "/var/named/zones/slave/root"; masters { 192.0.32.132; 192.0.47.132; 170.247.170.2; 192.33.4.12; 199.7.91.13; 192.5.5.241; 192.112.36.4; 198.97.190.53; 193.0.14.129; }; notify no; };


zone "adware.rpz.internal" { type master; file "/var/named/zones/rpz/adware.rpz.internal"; };
zone "blacklist.rpz.internal" { type master; file "/var/named/zones/rpz/blacklist.rpz.internal"; };
zone "fakenews.rpz.internal" { type master; file "/var/named/zones/rpz/fakenews.rpz.internal"; };
zone "gambling.rpz.internal" { type master; file "/var/named/zones/rpz/gambling.rpz.internal"; };
zone "porn.rpz.internal" { type master; file "/var/named/zones/rpz/porn.rpz.internal"; };
zone "social.rpz.internal" { type master; file "/var/named/zones/rpz/social.rpz.internal"; };
zone "whitelist.rpz.internal" { type master; file "/var/named/zones/rpz/whitelist.rpz.internal"; };
 

 
service named restart

dig @127.0.0.1 pornhub.com

cat /var/named/logs/rpz.log