rbldnsd(9)

NAME
rbldnsd - DNS daemon sutable for running DNS-based blocklists

SYNOPSYS
rbldnsd [options] zonetype:zonename...

DESCRIPTION

rbldnsd is a small DNS-protocol daemon which is designed to handle queries to DNS-based IP-listing or NAME-listing services. Such services are a simple way to share/publish a list of IP addresses or (domain) names which are "listed" for for some reason, for example in order to be able to refuse a service to a client which is "listed" in some blocklist.

Given a zone name like zone.example.com, rbldnsd will answer to DNS queries for A or TXT records of class IN within this zone. It refuses to answer to other types of queries.

rbldnsd is able to handle two basic types of zones - IP-listing zones and name-listing zones. For IP-listing zones, rbldnsd handles domains of the form d.c.b.a.zonename, where a.b.c.d is the IP address in question. For name-listing zones, rbldnsd handles domains of the form name.zonename, where name is the name in question. The base name of a zone, zonename, together with it's type, is given in command line.

Every entry listed in zones handled by rbldnsd may have it's own A and/or TXT records, or all records may share the same A and TXT records, optionally with special placeholder which will be replaced by the IP address in dotted-decimal form or by the name.

rbldnsd reads zone contents, i.e. list of IP addresses or names, from files named after the name of the zone, i.e. zone zone.example.com will be read from a file name `zone.example.com'. Interpretation of the file depends on a type of a zone.

It is possible to specify several zones on the command line, -- in this case, rbldnsd will serve queries to any of zones.

OPTIONS

The following options may be specified:

-u user[:group]
    rbldnsd will change it's userid to the specified user, which defaults to rbldnsd, and group, which by default is the primary group of a user. rbldnsd will refuse to run as root user, since this is insecure.

-r rootdir
    rbldnsd will chroot to rootdir if specified. Zone files should be available inside rootdir.

-w workdir
    rbldnsd will change it's working directory to workdir (after chrooting to rootdir if -r option is also specified). Zone files will be read from this directory.

-b [address][:port]
    rbldnsd will bind to specified address which defaults to a wildcard address, and port which defaults to 53 (standard DNS port).

-t ttl
    Set answer time-to-live value to be ttl secounds. All answers will contain ttl as a value of time-to-live field. Default is 2048.

-c check
    Set interval between checking for zone file changes to be check secounds, default is 60 (one minute). rbldnsd will check zone file's last modification time every so often, and if it detects a change, zone will be automatically reloaded. Setting this value to 0 disables automatic zone change detection. This procedure may also be triggered by sending SIGHUP signal to rbldnsd.

-p pidfile
    Write rbldnsd's pid to the specified pidfile, so it will be easily findable.

-n  Do not become a daemon. Normally, rbldnsd will fork and go to the background after successeful initialization. This option disables this behaviour.

ZONE TYPES

rbldnsd understands 2 types of zones and variants of syntax of zone files. Those types are:

ip4set (default if type is not specified)
    A list of IP addresses, with the ability to specify A and/or TXT record for each, with optional defaults for A and TXT. If the first line in a file starts with colon (:), it is interpreted as default value for A and TXT records, in a form:
      :1.2.3.4:text record value
    Any may be omitted. By default, rbldnsd will return IP address 127.0.0.2 as an answer to A query and will not return any TXT record. In the TXT field, any occurences of the dollar-sign ($) are replaced with queried IP address in dotted-decimal notation. Subsequent lines should contain an IP address range in CIDR format (if bitlength is omitted, it's default to /32), i.e. 127.0.0.0/25, with optional redundrand octets (i.e. 127.0.0.0/8 treated the same way as 127/8, 127.0/8, 127.0.0/8 and just 127), optionally followed by a whitespace and values for A and TXT records for this entry, in the same format as default values. If no value follows IP address range, or if A or TXT part is empty, default value is used. If a line starts with an exclamation mark, !, when the following is interpreted as an exception, that is, subsequent IP address range in CIDR format is excluded from the data. This is useful when listing a large block and whitelisting e.g a single address. Any text followed by an address in this case is ignored.

ip4set
    This is a list of IP addresses (or IP address ranges) which all share common A record and template for TXT record. The syntax is similar to ip4vset but all individual values, if given, are ignored. This zone type is more compact in memory compared with ip4vset type, since only IP address is stored for every record. First line is interpreted as the A value and TXT template for all the entries if it starts with a colon (:), just like for ip4vset zone type. Note there is no way to specify an exception like for ip4vset type.

dnvset
    A list of names, where every name may be assotiated with A and/or TXT record. First line may specify default A record and/or TXT record template if it starts with a colon (:). Subsequent lines each should contain a name which may follow by a whitespace and A/TXT values for this name. Name may begin with `.' or `*.', or a wildcard, to mean that any "subnames" of the name are listed. If a line contains with an exclamation sign, `!', the entry is excluded instead. This is useful to include a wildcard but exclude a given host which overwide will be covered by a wildcard. Any following A/TXT value is ignored in this case. When formatting TXT record, all occurences of dollar sign ($) from TXT template will be replaced by original name with was given in query, stripping off zone's base. For example, if the query was
      some.name.zone.example.com,
    zonename is zone.example.com, and the TXT template is
      http://www.example.com/listing?$
    TXT record produced will be
      http://www.example.com/listing?some.name

dnset
    Similar to dnvset, but all individual entry's values are ignored and default values are used instead. This zone type requires less memory since only domain names needs to be stored.

NOTES
Please note that currently, all zones are consulted in order specified in command line, until first matching zone (NOT first existing record) is found, that is, if DNS query ends up at the same string as the zone's base name. So, place subzones before a zone, e.g.
  dialups.relays.osirusoft.com
should come before combined
  relays.osirusoft.com
zone. Currently, rbldnsd does not reorder zones, in a hope that user knows better which zones will be accessed more frequently. This may be eliminated in the future by changing zone search algorithm (it's a linear search currently), and this is NOT as rbldnsd behaved before version 0.74.

VERSION
This manpage corresponds to rbldnsd version 0.74.

AUTHOR
The rbldnsd daemon written by Michael Tokarev <mjt@corpit.ru>, based on ideas by Dan Bernstein and his djbdns package.

LICENCE
GPL.