Уроки модуля (3/3)
Filtri DNS, sinkhole e RPZ
DNS filters, sinkholes, and RPZ
A DNS firewall can apply policy: block known malicious domains, rewrite an answer, or direct a client to a controlled sinkhole. Response Policy Zones (RPZ) are a format and approach used by some resolvers to distribute policy data. They are not an intrinsic property of DNS and do not replace endpoint security or network firewalls.
Indicator feeds can be wrong or out of date. Decide who approves a rule, how to handle false positives, how long a rule remains active, who can request an exception, and how to roll it back. Log the reason for a change and make it visible to operators.
For a confirmed phishing domain, a policy might return NXDOMAIN or send the client to an internal sinkhole for measurement. Do not redirect users to a page that imitates the blocked site. Consider DNSSEC: local rewriting can change validation guarantees and must be designed and documented in the resolver.
Check your understanding
Choose the best answer. The examples use training names and do not send real DNS queries.
What makes a DNS filter manageable?