[knot-resolver-users] Re: Introduction and questions about RPZ support

On 30/12/2025 10.58, Francis Turner wrote: I suppose the documentation should have examples, and there aren't many variants so far anyway.  You can't leave it blank.  To get both you write e.g.  log: [ name, ip ] Correct.  We don't support them yet.  Our docs says: Perhaps, can you share more information about typical use cases that you have for these missing features?  The thing is that the RPZ draft specifies very very complex mechanics how rules interact, and some of that would basically clash with what we have in Knot Resolver, so we don't follow all of that, but we certainly want to keep good support for use cases common in practice. https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-dns-rpz-00#section-5 Also, beware that in our current implementation the rule *.example.com. CNAME . will return NXDOMAIN also for example.com itself, contrary to what RPZ definition says. I can retest that later, but note that you need an extra dependency for the detection to work. https://repology.org/project/python:watchdog