RPZs

RPZs, short for Response Policy Zones, are a DNS-based mechanism that allows recursive DNS resolvers to apply configurable policies to their responses. A policy operator maintains an RPZ as a DNS zone containing rules that map domain names or patterns to specific actions. Resolvers that load the RPZ consult it for each query and, if a rule matches, apply the corresponding action before delivering the final answer to the client.

Common actions include returning NXDOMAIN or a blank answer to block access, or returning a redirection via a CNAME to a block page or to an approved site. The policy zone is separate from the authoritative zones for the queried domains and is distributed using standard DNS zone transfer methods. Updates to the RPZ propagate to resolvers as the policy zone is refreshed.

RPZs are used for DNS-based content filtering and security enforcement, including blocking malware, phishing, botnet command-and-control domains, and adult or illicit content in enterprise, ISP, or parental-control contexts. They can be deployed by operators themselves or obtained from public RPZ feeds.

Considerations include the potential for false positives, performance impact, and privacy concerns, as well as the need for secure policy delivery (for example, signing or integrity checks) to prevent tampering. Operators should provide graceful fallbacks when RPZ data is unavailable and carefully tune TTL and rule granularity to balance effectiveness with resolver load.

RPZs represent a pragmatic approach to DNS-based policy enforcement that complements other security controls and relies on existing DNS infrastructure and distribution mechanisms.