initial commit

deploy/zones/local.rpz.zone.example

@@ -0,0 +1,23 @@
+; Example RPZ-style policy zone.
+;
+; Drop everything from these services, for this host and its subdomains.
+$TTL 60
+@ SOA localhost. hostmaster.localhost. 1 3600 600 604800 60
+@ NS  localhost.
+
+; *.doubleclick.net CNAME .   -> NXDOMAIN
+*.doubleclick.net       CNAME .
+*.ads.example.com       CNAME .
+*.tracker.example.net   CNAME .
+analytics.example.org   CNAME .
+
+; CNAME rpz-drop. -> answer with silence
+*.noisy-cdn.example     CNAME rpz-drop.
+
+; CNAME rpz-passthru. -> ignore blocklists for this name
+metrics.internal.       CNAME rpz-passthru.
+
+; A/AAAA records in a policy zone are returned verbatim, which is the cleanest
+; way to point a blocked name at a local landing page.
+blocked.example         A     192.0.2.10
+                       AAAA  2001:db8::10