Lion Cipher Lab

Block malicious domains with DNS RPZ (build a DNS firewall in BIND 9)

• Cyber / Security Engineer
• Advanced
• ~90 min
• Free · no account required

Why it matters

Almost every attack has to resolve a name first: the phishing link, the malware's command-and-control callback, the data-exfiltration endpoint. That makes the recursive resolver — the box that turns names into IP addresses — one of the highest-leverage choke points in a network. Response Policy Zones (RPZ) turn that resolver into a programmable DNS firewall: you write policy that says 'this name does not exist,' 'send this name to a warning page instead,' or 'this whole domain and its subdomains are off-limits,' and the resolver enforces it for everyone behind it. National cyber agencies now…

What you'll learn

• what a Response Policy Zone (RPZ) is and why it is called a 'DNS firewall'
• standing up a recursive BIND 9 resolver in a disposable Docker container
• authoring an RPZ zone file from scratch: block, redirect, wildcard, allowlist
• the RPZ policy TRIGGERS (QNAME, IP, NSDNAME, NSIP, CLIENT-IP)
• the RPZ ACTIONS (NXDOMAIN, NODATA, PASSTHRU, DROP, and local-data redirect)
• wiring in a live reputation feed (abuse.ch URLhaus) as an RPZ with periodic refresh
• turning on RPZ query logging and reading a real rewrite log line
• proving policy with dig: a blocked name vs a redirected name vs an allowed name
• the hard limits: DoH/DoT bypass, hardcoded resolvers, ECH — RPZ as control plane not guarantee

Steps in this lab

1. What RPZ is, and why people call it a DNS firewall
2. The two halves of every RPZ rule: TRIGGERS and ACTIONS
3. Stand up a disposable BIND 9 resolver in Docker
4. Write the resolver config (named.conf) with RPZ and logging turned on
5. Author your RPZ zone from scratch: block, redirect, wildcard, allowlist
6. Wire in a live reputation feed (abuse.ch URLhaus) as an RPZ
7. PROVE it: dig a blocked name, a redirect, an allowed name, and a feed hit
8. Keep the feed fresh: periodic refresh
9. The hard limits — and when NOT to trust RPZ alone

Open the full interactive lab →