Concepts / Detection and response

Detection and response

Response policy zone (RPZ)

Also called rpz, policy zone, dns firewall, local-zone

A zone of DNS policy rules a resolver loads, overriding answers for listed names in bulk.

Rather than one command per bad domain, a response policy zone is a whole zone file of names and the answers to force — redirect to a sinkhole, return NXDOMAIN, or leave alone. The resolver loads and updates it like any zone, so threat-intelligence feeds of bad domains can be applied to every client at once and refreshed continuously. It is the production form of the sinkhole built by hand in the lab.

See it on real machines

Learn it on real machines.

Every lab is a small network of real Linux machines in your browser. Start with a free account: Google or email, no card.

Open this lab