eric-l...@truenet.com <eric-l...@truenet.com> wrote: > Actually, how are other places implementing these lists? I would have > thought to use RPZ, but as far as I know if the blocked DNS domain is > using DNSSEC it wouldn't work.
You can configure RPZ with the "break-dnssec" option which means validating clients will fail to resolve the blocked domains. DNSSEC only protects you from getting bad answers. If someone wants you to get no answers at all then DNSSEC cannot help. Tony. -- f.anthony.n.finch <d...@dotat.at> http://dotat.at/ Tyne, Dogger, Fisher: Southwest 6 to gale 8, occasionally severe gale 9 at first. Rough or very rough, becoming mainly moderate in Tyne. Rain or showers. Good, occasionally poor.
