<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Thanks, Bert, et. al.! Based on this feedback and <a href="https://github.com/fumiyas/pdns-scripts/blob/master/recursor/filter-aaaa.lua" class="">https://github.com/fumiyas/pdns-scripts/blob/master/recursor/filter-aaaa.lua</a>, I tried this, and it seems to be working:<div class=""><br class=""></div><div class="">blacklisted = newDS()<br class="">blacklisted:add{"<a href="http://netflix.com" class="">netflix.com</a>"}<br class="">blacklisted:add{"<a href="http://netflix.net" class="">netflix.net</a>"}<br class=""><br class="">function postresolve(dq)<br class=""> if blacklisted:check(dq.qname) then<br class=""> local records = dq:getRecords()<br class=""> local records_new = {}<br class=""><br class=""> for i, record in ipairs(records) do<br class=""> if record.type ~= pdns.AAAA then<br class=""> records_new[#records_new + 1] = record<br class=""> end<br class=""> end<br class=""><br class=""> dq:setRecords(records_new)<br class=""> end<br class=""><br class=""> return true<br class="">end</div><div class=""><br class=""></div><div class="">Now to see if the Netflix apps start behaving any better…</div><div class=""><br class=""></div><div class="">Thanks!</div><div class=""><br class=""></div><div class="">Nick<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Oct 7, 2019, at 1:47 AM, bert hubert <<a href="mailto:bert.hubert@powerdns.com" class="">bert.hubert@powerdns.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hello everyone,<br class=""><br class="">I used to use this script:<br class=""><br class="">--[[ <br class=""> Sometimes, domains break when IPv6 is used. A common example is<br class=""> Netflix via an IPv6 tunnel, which Netflix interprets as a proxying <br class=""> attempt.<br class=""><br class=""> This function strips IPv6 from one or more subdomains. It can be called<br class=""> with a single domain, like "<a href="http://netflix.com" class="">netflix.com</a>", or with a domain set, which<br class=""> is more efficient and scales very well.<br class=""><br class=""> This file is meant for including, so you can call it from your preresolve.<br class=""> Alternatively, uncomment the activation code below and you can load it<br class=""> directly into your resolver with 'lua-dns-script=strip-ipv6-from-domains.lua'.<br class="">]]--<br class=""><br class="">function preventIPv6ForDomains(dq, domain)<br class=""> local ds=newDS()<br class=""> if(type(domain) == "string") then<br class=""> ds:add{domain}<br class=""> else<br class=""> ds=domain<br class=""> end<br class=""> if(dq.qtype ~= pdns.AAAA) then return false end<br class=""> if(ds:check(dq.qname)) then<br class=""> dq.rcode = 0<br class=""> return true<br class=""> end<br class=""> return false<br class="">end<br class=""><br class="">-- To activate, uncomment the block below:<br class=""><br class="">netflix=newDS()<br class="">netflix:add{"<a href="http://netflix.com" class="">netflix.com</a>"}<br class=""><br class="">function preresolve(dq)<br class=""> return preventIPv6ForDomains(dq, "<a href="http://netflix.com" class="">netflix.com</a>")<br class="">end<br class=""><br class="">Perhaps useful.<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Bert<br class=""><br class=""><br class="">On Mon, Oct 07, 2019 at 02:23:07AM -0400, Aleksandr Rogozin via Pdns-users wrote:<br class=""><blockquote type="cite" class="">Hi Nick,<br class=""><br class="">Since your request was to filter based on specific domains for qtype AAAA<br class="">with custom response, I suggest looking into Response Policy Zone (RPZ) or<br class="">LUA script.<br class=""><br class="">Best Regards,<br class="">Aleksandr<br class=""><br class="">On Sat, Oct 5, 2019 at 23:10 Nicholas Williams <<br class=""><a href="mailto:nicholas@nicholaswilliams.net" class="">nicholas@nicholaswilliams.net</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">I’ve got a conundrum that has kind of come to a head for me. It may be<br class="">2019, but Comcast is still too incompetent to provide me with<br class="">properly-working IPv6, so I’ve resorted to using a Hurricane Electric<br class="">tunnel for IPv6 access. However, Netflix blocks all Hurricane Electric and<br class="">similar tunnels under the assumption that you’re trying to scam their<br class="">location identification and access content that you don’t have geographic<br class="">access to and, worse, the Netflix apps prefer IPv6 over IPv4 when it’s<br class="">available, so Hurricane Electric users are kinda screwed.<br class=""><br class="">In the past, I’ve dealt with this by adding a black hole route for<br class="">Netflix’s IPv6 prefix. However, I’m now having to block THREE /48 prefixes<br class="">in order to keep Netflix working, and from what I can tell that means I’m<br class="">now blocking most of AWS’s enter CDN, so I’m losing out on IPv6 on a bunch<br class="">of sites.<br class=""><br class="">This solution is really like using a sledgehammer to install a picture<br class="">frame hanger (and having to replace the picture frame hanger every few<br class="">months). A better solution is to prevent Netflix from doing AAAA lookups<br class="">(or somehow filter them and respond with only A results). I’m already using<br class="">PowerDNS Recursor for my DNS. Is there a way I can configure PowerDNS<br class="">Recursor so that certain domains (like Netflix) respond with only A results<br class="">and never return AAAA results, so that I can remove my blackhole routes?<br class=""><br class="">Thanks,<br class=""><br class="">Nick<br class=""><br class="">_______________________________________________<br class="">Pdns-users mailing list<br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" class="">Pdns-users@mailman.powerdns.com</a><br class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users<br class=""><br class=""></blockquote></blockquote><br class=""><blockquote type="cite" class="">_______________________________________________<br class="">Pdns-users mailing list<br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" class="">Pdns-users@mailman.powerdns.com</a><br class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users<br class=""></blockquote><br class=""></div></div></blockquote></div><br class=""></div></body></html>