; Example RPZ-style policy zone.
;
; Drop everything from these services, for this host and its subdomains.
$TTL 60
@ SOA localhost. hostmaster.localhost. 1 3600 600 604800 60
@ NS  localhost.

; *.doubleclick.net CNAME .   -> NXDOMAIN
*.doubleclick.net       CNAME .
*.ads.example.com       CNAME .
*.tracker.example.net   CNAME .
analytics.example.org   CNAME .

; CNAME rpz-drop. -> answer with silence
*.noisy-cdn.example     CNAME rpz-drop.

; CNAME rpz-passthru. -> ignore blocklists for this name
metrics.internal.       CNAME rpz-passthru.

; A/AAAA records in a policy zone are returned verbatim, which is the cleanest
; way to point a blocked name at a local landing page.
blocked.example         A     192.0.2.10
                       AAAA  2001:db8::10