; Example RPZ-style policy zone.
;
; Drop everything from these services, for this host and its subdomains.
;
; As in local.example.zone, every owner name is fully qualified. A policy zone
; is read with the origin taken from the file name (internal/blocklist prepends
; `$ORIGIN` per file), so a relative `*.doubleclick.net` in a file called
; local.rpz.zone.example becomes *.doubleclick.net.local. — a rule that blocks
; nothing you care about. Absolute owner names are the only spelling that is
; independent of what the file is called; TestExampleRPZZoneBlocksWhatItSays
; in internal/blocklist pins that the example blocks what its comments claim.
$TTL 60
localhost.        SOA     localhost. hostmaster.localhost. 1 3600 600 604800 60
localhost.        NS      localhost.

; *.doubleclick.net CNAME .   -> NXDOMAIN
*.doubleclick.net.        CNAME .
*.ads.example.com.        CNAME .
*.tracker.example.net.    CNAME .
analytics.example.org.    CNAME .

; CNAME rpz-drop. -> answer with silence
*.noisy-cdn.example.      CNAME rpz-drop.

; CNAME rpz-passthru. -> ignore blocklists for this name
metrics.internal.         CNAME rpz-passthru.

; A/AAAA records in a policy zone are returned verbatim, which is the cleanest
; way to point a blocked name at a local landing page.
blocked.example.          A     192.0.2.10
                          AAAA  2001:db8::10