<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 09/04/2026 10:24, rob777 via
Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAAPVCxy-9HXLV0CrBD6UqrpFzt_bntgEN7h07KyqSOvXwicLTA@mail.gmail.com">
<blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Response Policy Zone on the recursor is the way I'd do it.
This is what RPZ is designed for: to override specific DNS
answers.</p>
</div>
</blockquote>
<div> </div>
<div>I've used to do it with Bind Views in the past as i've had
BIND running. As i've migrated to Powerdns this generated some
issues obviously since bind view wasnt available then and it has
to be done with LUA Records.</div>
<div><br>
</div>
<div>This historical thing with Shadow Records is something that
is difficult to clean up and fix for different reasons. And it
regularly comes back and bites me in the ass..</div>
</blockquote>
<p>RPZs are the "standard" mechanism for this; people use it for
things like ad and porn blocking, but really it does exactly what
you need. PowerDNS has had it for ten years:
<a class="moz-txt-link-freetext" href="https://blog.powerdns.com/2016/06/28/response-policy-zone-support-in-powerdns-recursor">https://blog.powerdns.com/2016/06/28/response-policy-zone-support-in-powerdns-recursor</a></p>
<p>Example YAML config:</p>
<p><font face="monospace">recursor:<br>
rpzs:<br>
- name: /etc/powerdns/rpz.zone</font></p>
<p># content of file /etc/powerdns/rpz.zone</p>
<p><font face="monospace">$TTL 300<br>
@ IN SOA localhost. root.localhost. (<br>
2026040900 60 60 43200 60<br>
)<br>
IN NS localhost.<br>
<a class="moz-txt-link-abbreviated" href="http://www.powerdns.com">www.powerdns.com</a> A 1.2.3.4</font></p>
<p># Testing:</p>
<p><font face="monospace">dig @localhost <a class="moz-txt-link-abbreviated" href="http://www.powerdns.com">www.powerdns.com</a>. a<br>
<br>
...<br>
<br>
;; ANSWER SECTION:<br>
<a class="moz-txt-link-abbreviated" href="http://www.powerdns.com">www.powerdns.com</a>. 268 IN A 1.2.3.4</font><br>
</p>
<p>It's as simple as that. In this single zone, you list all the
records you want to override, as subdomains of the policy zone
(hence no dot after "<a class="moz-txt-link-abbreviated" href="http://www.powerdns.com">www.powerdns.com</a>" in the example above).</p>
<p>If you wish, you can make the RPZ a real DNS zone under a domain
you control (e.g. rpz.test.com) and then the recursor(s) can fetch
it using AXFR. Then you can manage it using whatever tools you use
normally to manage zone contents, and multiple recursors can fetch
the same zone. The above example bypasses this by using a local
file.</p>
<p>There are other actions you put in RPZs to manipulate the
responses: for example a "CNAME ." record will give an NXDOMAIN
response. Docs aren't hard to find.</p>
<p>Regards,</p>
<p>Brian.</p>
</body>
</html>