search

CZ-NIC / knot-resolver

Knot Resolver - resolve DNS names like it's 2024
https://www.knot-resolver.cz/
Other
362 stars 59 forks source link

Hide upstream resolver from dns query answer #110

Open Streametch opened 4 months ago

Streametch commented 4 months ago

Hello, Some services, like anti spam Rbl lists, detect dns resolver public or not. If knot-resolver using forward rules to public resolvers like google/cloudflare then access to antismap RBL's may fails. Is any way how to excludes RBL's domains from forwarding, or maybe some tricks how to hide or replace upstream resolvers from query answer?

vcunat commented 4 months ago

In 5.x version you can use the .PASS action to skip over all further rules (including forwarding rules). So if you put this early enough and conditioned to trigger only on some QNAME subtrees, I believe it will work.

In 6.x this isn't doable in a reasonable way yet, I think.

vcunat commented 4 months ago

6.x: a different forwarding specification as exception should work there, so if you e.g. find a resolver that's not so well known or if you have another non-forwarding instance...