How do I create and maintain my DNS firewall policy rule set using DNS RPZ?


In a DNS RPZ firewall, the policy rule set is contained in a DNS "zone", which can be transferred using normal "zone transfer" mechanisms. The master copy of your DNS firewall policy can be a DNS "zone file" which you either edit by hand, or which you generate from a database.  You can also edit a DNS zone indirectly using DNS dynamic updates (for example, using the "nsupdate" shell level utility.)  The format of the Response Policy Zone is described here: DNS Response Policy Zones - Specification - Format 3.

See also: Building DNS Firewalls with Response Policy Zones (RPZ)