RPZ

networkingsecurity

Stands for: Response Policy Zone

A DNS mechanism for rewriting or blocking answers by policy.

A Response Policy Zone lets a resolver override DNS answers - returning NXDOMAIN, a walled-garden address, or a custom record - for domains on a threat feed. It turns DNS into an enforcement point using ordinary zone-transfer machinery.

Response policy zones let a resolver override DNS answers according to a policy feed, returning a block page or NXDOMAIN for names on a list. It is how most DNS filtering is implemented, from malware blocking to content control.

Its strengths and objections are the same mechanism seen from different sides. It is fast, cheap and effective against threats that depend on resolving a name, and it is also a censorship tool that lies to the client by design. It fails against anything using hardcoded addresses or its own encrypted resolver, which is why encrypted DNS on endpoints is in direct tension with network-level filtering, and why that tension is an ongoing argument rather than a settled question.

Also known as: rpz

← All glossary entries