DNS Firewall(FRW) Response Policy Zones (RPZ)

RPZ (Response Policy Zone) allows a nameserver to modify DNS responses based on policies. It's often used for implementing security measures, such as blocking known malicious domains, redirecting domains, or applying other customized policies. When a query matches an RPZ policy, the DNS server can return a different answer than what is stored in the authoritative data.

A DNS Firewall using Response Policy Zones (RPZ) is a powerful mechanism in DNS servers for implementing custom security policies. It's often used for implementing security measures, such as blocking known malicious domains, redirecting domains, or applying other customized policies. When a query matches an RPZ policy, the DNS server can return a different answer than what is stored in the authoritative data. It effectively allows DNS administrators to override DNS responses based on predefined policies, enhancing security and control over network traffic. 

Here's what DNS Firewall RPZ does:

1. Intercepts DNS Queries: When a client device makes a DNS query, the DNS Firewall with RPZ intercepts this query. It then checks the requested domain name against a set of policy rules.
2. Uses Policy Zones (RPZs): RPZs are special DNS zones that contain lists of domain names along with the policy actions to be applied to them. These can include known malicious domains, domains associated with phishing, spam, or domains that an organization wants to block for other reasons.
3. Overrides Standard Responses: Based on the RPZ rules, the DNS Firewall can modify the standard DNS response. For instance, if a client requests a domain that is listed in the RPZ as malicious, the DNS Firewall can redirect it to a safe page, block the request, or provide an alternate response.
4. Prevents Access to Harmful Sites: By redirecting or blocking requests to dangerous or unwanted domains, DNS Firewall RPZs protect users from malware, phishing attacks, and other cyber threats.
5. Customizable and Flexible: Administrators can create custom RPZs tailored to their organization’s specific security needs. They can also subscribe to third-party RPZ feeds, which are regularly updated lists of harmful domains.
6. Logging and Reporting: DNS Firewall RPZs can log queries to blocked domains, providing valuable insights into attempted access to harmful sites and helping to identify patterns of malicious activity.
7. Complements Other Security Measures: While not a standalone security solution, DNS Firewall RPZ is an effective layer in a multi-layered security strategy, complementing firewalls, intrusion detection systems, and other security measures.

To create a RPZ in DDI Central:

• Go to DNS-> Domains. Click on Add Domain button on the top right corner.
• On the Create Domain page, Choose the type of the domain as Response Policy Zone (RPZ).

• You can create the RPZ  just like how an authoritative zone is created and the records are added. It is just you are controlling the local access to a publicly available suspicious domain with customized safe IPs.
• Configure various types of individual records for the RPZ offered by DDI Central, so that whenever a client in your network queries for any subdomain or domain configured as RPZ, it is the custom response you configured will be visible to the client in your network. 
• DDI Central logs the queries to the RPZs and the different views configured for it. All the stats can be visualized under DNS-> Analytics page.
• An RPZ cannot have dynamic configurations. DDI Central enables you to apply a variety of DNS options to RPZs to have a granular control over the clients accessing it.
• DNS Firewall with RPZ is a proactive tool for enhancing network security by controlling and modifying DNS responses based on an organization's policies, thereby safeguarding the network from various online threats and undesirable content.