I also have a webserver that any black holed domain is sent to so that there is no waiting for a web request to time out. The first time I put it in place I didn't have the webserver so the performance when hitting one of these was horrible. I also use it for any ad server or analytic site I want to permanently block.
This way I don't have to distribute and update a hosts file to every machine in the house and I control where the offending sites redirect too.
I have been creating master zones on my named.conf and pointing them to a blocked.txt file. My method is more cumbersome, the one you linked is very streamlined. Excellent, and thanks!
First, create a zone file that all of the domains will share. I put mine in /var/named/master/dummy:
$TTL 1d
@ IN SOA ns1.localdomain. hostmaster.ns1.localdomain. (
2012100601 ; serial
8h ; refresh
2h ; retry
7d ; expire
1h ; default_ttl
)
;
; Name servers
;
@ IN NS ns1.localdomain.
@ IN NS ns2.localdomain.
;
; Host addresses
; Leave commented to return NXDOMAIN
; Uncomment to resolve to IP address
;@ IN A 127.0.0.1
I prefer not resolve these hosts at all (NXDOMAIN), because it seems to be faster and I don't want client machines to probe themselves, but you can uncomment the A record and use whatever IP address you want (e.g. for sinkhole monitoring). Remember to increment the serial number with every edit (which will be rare or never, once you've set it to your liking).Next, create a simple file with each domain you want to block on one line. I put mine in /var/named/dummy:
ads.example.com
tracker.example.com
example.org
Now create a conf file in the format bind expects, pointing every domain to the zone file (for convenience, put this in /var/named/Makefile in a 'dummy' target): sed 's/.*/zone "&" { type master; file "master\/dummy"; };/' < dummy > dummy.conf
Which will result in /var/named/dummy.conf containing: zone "ads.example.com" { type master; file "master/dummy"; };
zone "tracker.example.com" { type master; file "master/dummy"; };
zone "example.org" { type master; file "master/dummy"; };
Finally, add to your named.conf: include "/var/named/dummy.conf";
Restart bind and you're now authoritative for those zones on your network!One of these days I'm gonna roll my own DNS server in Python with a sane configuration syntax.