I use RPZ to blacklist some domains and my configuration looks like:*.com A 127.0.0.1  mydomain.net A 127.0.0.1if i query a whatever domain .com it works correctly giving me 127.0.0.1let's dig fun.com @localhost, my reply will be:;; ANSWER SECTION:fun.com.     5       IN      A       127.0.0.1now let's edit the previous config and make my zone now look like:*.com A 127.0.0.1  mydomain.net A 127.0.0.1this.fun.com 127.0.0.1It's unnecessary because the master *.com should cover all the cases however I have my domains loaded by multiple sources so the list is compiled automatically and things like this can happen.While this seems to be an harmless change and if I do dig this.fun.com @localhost it will reply again stuff like:;; ANSWER SECTION:this.fun.com.     5       IN      A       127.0.0.1If I now query the root domain dig fun.com @localhost I will get:;; ANSWER SECTION:fun.com.                86400   IN      A       209.61.131.188Like.. WHAAT? What happened here? adding this.fun.com masked out fun.com main domain from the upper omni-inclusive *.com?Is this a wanted behaviour of bind? Did I found some kind of weird bug?How can avoid this? Should I write a script that recurse all the domains removing the ones contained into the bigger ones? (annoying but doable - in search of better alternatives)TL;DR: Add of a 3rd level domain in bind rpz in order to BLACKLIST IT make the 2nd level domain not follow the main FILTER resulting WHITELISTED.
Bind RPZ config with domains of various levels
linux;dns;bind;bind9;rpz