32 lines
1.3 KiB
Plaintext
32 lines
1.3 KiB
Plaintext
; Example RPZ-style policy zone.
|
|
;
|
|
; Drop everything from these services, for this host and its subdomains.
|
|
;
|
|
; As in local.example.zone, every owner name is fully qualified. A policy zone
|
|
; is read with the origin taken from the file name (internal/blocklist prepends
|
|
; `$ORIGIN` per file), so a relative `*.doubleclick.net` in a file called
|
|
; local.rpz.zone.example becomes *.doubleclick.net.local. — a rule that blocks
|
|
; nothing you care about. Absolute owner names are the only spelling that is
|
|
; independent of what the file is called; TestExampleRPZZoneBlocksWhatItSays
|
|
; in internal/blocklist pins that the example blocks what its comments claim.
|
|
$TTL 60
|
|
localhost. SOA localhost. hostmaster.localhost. 1 3600 600 604800 60
|
|
localhost. NS localhost.
|
|
|
|
; *.doubleclick.net CNAME . -> NXDOMAIN
|
|
*.doubleclick.net. CNAME .
|
|
*.ads.example.com. CNAME .
|
|
*.tracker.example.net. CNAME .
|
|
analytics.example.org. CNAME .
|
|
|
|
; CNAME rpz-drop. -> answer with silence
|
|
*.noisy-cdn.example. CNAME rpz-drop.
|
|
|
|
; CNAME rpz-passthru. -> ignore blocklists for this name
|
|
metrics.internal. CNAME rpz-passthru.
|
|
|
|
; A/AAAA records in a policy zone are returned verbatim, which is the cleanest
|
|
; way to point a blocked name at a local landing page.
|
|
blocked.example. A 192.0.2.10
|
|
AAAA 2001:db8::10
|