Response policy zones (RPZ) are a mechanism used in DNS servers to enforce security policies by modifying DNS responses based on predefined rules. These zones are primarily used to block or redirect DNS queries for malicious domains, phishing sites, or other undesirable internet locations.

We recommend that you create a separate forward zone on the Authoritative DNS server for Response Policy Zones. The zone can be either primary or secondary, and the data can either be manually entered or transferred from a third party Response Policy Zones provider. The zones can be named as rpz.<customer-domain> to avoid conflict with domain names in the Global DNS space.

Note	If the Response Policy Zones come via zone transfer, it must be named the same as at the source. If using a commercial Response Policy Zones provider, the name is specified by the provider.

Each policy consists of a trigger and an action. The trigger describes when the policy should be applied. The action describes what action should be taken if the policy needs to be applied.

In Response Policy Zones zone, each trigger and action combination is defined as a Resource Record (RR). The owner of the RR states the trigger, and the type, and RDATA state the action.

The Response Policy Zones RR names can take the following forms:

This zone contains all the RRs related to query names which are in block list. Blocking IP addresses and ranges must be done within the rpz-ip label (that is, rpz-ip.rpz.cisco.com). The same logic can be applied to blocking name servers and clients using the rpz-nsdname, rpz-nsip, and rpz-client-ip labels.

Note	rpz-ip, rpz-nsdname, rpz-nsip, and rpz-client-ip are just another labels and are not real subdomains or separate zones. No delegation points will exist at this level and Caching DNS server relies on finding all the data within the referenced zone.

Note	When using rpz-nsdname and rpz-nsip, the corresponding rule is applied to the original query and will therefore change the answer section. In cases when the final answer is determined from the Response Policy Zone rule(s), the Response Policy Zone SOA will be included in the authority section.

Response Policy Zones rules are created using standard DNS RRs, mostly CNAME RRs. However, for redirecting, you can use any type of RR. The RR name follows the format based on the Response Policy Zones triggers. The rdata defines the rule action to be taken. The following table describes the Response Policy Zones actions.

• All Response Policy Zones must have the rpz attribute enabled. A DNS reload is necessary for this change to take effect.

• The restrict-query-acl should be set to localhost to protect the firewall rule data from being queried.

• The restrict-xfer-aclshould be set to the list of DNS servers accessing this RPZ data. It may also be helpful to specify localhost for administrative purposes.

• Notify should set set to notify-list and notify-list should contain the list of CDNS servers using RPZ data.

• Response Policy Zone must not be delegated from the parent zone. It must be hidden and only available to a specially configured Caching DNS.

• There must be no Response Policy Zone nameserver address record to avoid caching and keeping the name server.

• The name server record must point to "localhost".

• The number of Response Policy Zone Firewall rules on a Caching DNS server should be limited to 2-3.

• The default TTL, for manually created Response Policy Zones must reflect the rate of change in the zone data. The recommended rate ranges from 5m to 2h.

• An Response Policy Zones may contain data for domains (allowed list or block list), but can also be separated into two distinct zones. This can be helpful when there is overlapping data or the block list zone is maintained by a third party (that is, Response Policy Zones subscription).

Note	The 'rpz' attribute should only be enabled for CDNS versions 11.1.x or older. It must NOT be configured for CDNS versions 11.2 or later.