On 12/01/2026 00.11, * wrote:
> However, I cannot use it in my production environment as this returns
> NODATA globally (all views) for security.ubuntu.com.
> I have several views not using dns64 for which the AAAA record should
> be the existing original answer.
While on Lua level it's not ergonomic, tags are supported in these APIs,
so you can do a tiny change, e.g.:
lua:
policy-script: |
assert(C.kr_rule_local_data_ins(
kres.rrset(kres.str2dname('security.ubuntu.com.'),
kres.type.AAAA, nil, C.KR_RULE_TTL_DEFAULT),
nil, policy.get_tagset({'myTag'}), C.KR_RULE_OPTS_DEFAULT
) == 0)
and then you just need to add myTag to the views where you want to apply
this rule (in YAML).
You can read more about tags and views in the docs, around page
https://www.knot-resolver.cz/documentation/latest/config-policy-new.html
Hello,
I'm using this config.yaml with Knot Resolver 6 (on Debian 13):
workers: auto
network:
listen:
- interface: 127.0.0.1@53
logging:
level: info
options:
violators-workarounds: true
cache:
size-max: 100M
prefetch:
expiring: true
dnssec:
log-bogus: true
local-data:
rpz:
- file: /var/lib/rpz/urlhaus.abuse.ch.rpz
- file: /var/lib/rpz/threatfox.abuse.ch.rpz
lua:
script: |
policy.add(policy.suffix(policy.DENY, {todname('use-application-dns.net.')}))
policy.add(policy.suffix(policy.PASS, policy.todnames({
'uribl.com',
'zen.spamhaus.org',
'dbl.spamhaus.org',
'list.dnswl.org',
'sa-trusted.bondedsender.org',
'sa-accredit.habeas.com',
'bl.score.senderscore.com',
'dnsbl-1.uceprotect.net',
'dnsbl-2.uceprotect.net',
'dnsbl-3.uceprotect.net'
})))
policy.add(policy.all(policy.TLS_FORWARD({
{'9.9.9.9', hostname='dns.quad9.net', ca_file='/etc/ssl/certs/ca-certificates.crt' },
{'149.112.112.112', hostname='dns.quad9.net', ca_file='/etc/ssl/certs/ca-certificates.crt' },
})))
This results in this endless loop in the logs:
Apr 10 11:56:49 supervisord[56300]: captured stdio output from policy-loader[56777] (stderr): [system] config 'policy-loader.conf' (workdir '/run/knot-resolver'): No such file or directory
Apr 10 11:56:49 supervisord[56300]: success: policy-loader entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
Apr 10 11:56:49 supervisord[56300]: exited: policy-loader (exit status 1; not expected)
Apr 10 11:56:49 supervisord[56300]: spawned: 'policy-loader' with pid 56778
Apr 10 11:56:49 supervisord[56300]: captured stdio output from policy-loader[56778] (stderr): [system] config 'policy-loader.conf' (workdir '/run/knot-resolver'): No such file or directory
Apr 10 11:56:49 supervisord[56300]: success: policy-loader entered RUNNING state, process has stayed up for > than 0 seconds (startsecs)
Apr 10 11:56:50 supervisord[56300]: exited: policy-loader (exit status 1; not expected)
When using only one rpz file, thus removing the whole line
- file: /var/lib/rpz/threatfox.abuse.ch.rpz
it works fine.
What am I doing wrong here?
--
Frederik Himpe <frederik(a)frehi.be>