Detection and response
Response policy zone (RPZ)
A zone of DNS policy rules a resolver loads, overriding answers for listed names in bulk.
Rather than one command per bad domain, a response policy zone is a whole zone file of names and the answers to force — redirect to a sinkhole, return NXDOMAIN, or leave alone. The resolver loads and updates it like any zone, so threat-intelligence feeds of bad domains can be applied to every client at once and refreshed continuously. It is the production form of the sinkhole built by hand in the lab.