1

I have setup a BIND9 server on host so that I can block malicious websites on my network. I have used OZNU's DNS Zone Blacklist tool to generate the desired blacklist. Overall, it works really well. However, I encountered some issues with some legitimate domains, such as www.austrian.com. The DNS will resolve to a 0.0.0.0 ip.

Using dig @localhost www.austrian.com results into the following output:

; <<>> DiG 9.11.5-P4-5.1-Debian <<>> @localhost www.austrian.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23905
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 935fe58262a7e3cfd1aa5d1b5d507537d4ced7fb2768fc25 (good)
;; QUESTION SECTION:
;www.austrian.com.              IN      A

;; ANSWER SECTION:
www.austrian.com.       61      IN      CNAME   www.austrian.com.edgekey.net.
www.austrian.com.edgekey.net. 4904 IN   CNAME   e7818.dsca.akamaiedge.net.
e7818.dsca.akamaiedge.net. 864000 IN    A       0.0.0.0

;; AUTHORITY SECTION:
akamaiedge.net.         864000  IN      NS      ns0.example.net.

;; Query time: 49 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Aug 11 22:06:15 CEST 2019
;; MSG SIZE  rcvd: 193

The above output seems to be the null.zone.file file. I have tried whitelisting the domain in the custom.whitelist.json, but without luck. I have other whitelisted domains which do work. Any ideas?

Thanks.

Edit: named.conf.options:

options {

        querylog no;
        directory "/var/cache/bind";
        listen-on { any; };
        auth-nxdomain no;    # conform to RFC1035
        recursion yes;                 # enables resursive queries
        allow-query { any; };

        forwarders {
                1.1.1.1;
                8.8.4.4;
        };
        dnssec-validation auto;
};

logging {
  ...
};
Comforse
  • 117
  • 7

1 Answers1

0

SOLUTION:

It appeared that my custom.blacklist.json file had the following two entries:

akamaiedge.net
akamaitechnologies.net

While it may not be obvious straight away, www.austrian.com uses both of the above domains. The akamaiedge.net is in the dig response in my original question, while the reverse DNS for www.austrian.com is a subdomain of akamaitechnologies.net.

Removing the two entries from the custom.blacklist.json solved the issue.

Comforse
  • 117
  • 7