[knot-resolver 6] RPZ Wildcard support

[pschichtel]

Hi everyone!

It seems that with the switch to knot-resolver 6 support for wildcard entries in RPZ files got lost.

The section on records says that wildcards are not supported, but the RPZ section does not.

Reverting back to 5.7.6 and a basically equivalent kresd.conf restored wildcard support.

The config on 6.2.0:

workers: 4

network:
  listen:
    - interface: 127.0.0.1@5353

logging:
  level: info

monitoring:
  metrics: always

cache:
  size-max: 200M
  prefill:
    - origin: "."
      url: https://www.internic.net/domain/root.zone
      refresh-interval: 12h
  prefetch:
    expiring: true
    prediction:
      enable: true
      window: 30m
      period: 48

options:
  serve-stale: true

local-data:
  rpz:
    - file: /etc/knot-resolver/local_domains.rpz
      watchdog: true

and this is the config on 5.7.6:

net.listen('127.0.0.1', 5353, { kind = 'dns' })

modules = {
        'hints > iterate',
        'stats',
        'predict',
        'serve_stale < cache',
        'workarounds < iterate',
}

cache.size = 200 * MB
predict.config({
    window = 30,
    period = 24*(60/15)
})

policy.add(policy.rpz(policy.DENY, '/etc/knot-resolver/local_domains.rpz', true))
log_groups({'policy'})

[vcunat]

The section on records says that wildcards are not supported, but the RPZ section does not.

The section on RPZ in 6.2.0 says

wildcard support is limited only to blocking subtrees by *.some.name. CNAME . or *.some.name. CNAME *.

[vcunat]

Incidentally, we're just now extending the wildcard support in https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1808 though I don't know if that's the part you want (you don't show the RPZ file itself).

[pschichtel]

I used an RPZ file with 2 wildcard for 2 use-cases:

1. overwrite a publicly hosted zone to local IPs as part of my split-DNS setup
2. basically a locally hosted zone without an authoritive server, which is used only for local things

The latter might have been abuse of the feature to avoid also running an authoritive server, but the former seems like a common use-case for split-DNS setup.

How would I got about overwriting an entire set of domains by wildcard in knot-resolver 6+ ?

[vcunat]

After that merge request (which will be in future versions, i.e. greater than 6.2.0) I'd do something like this RPZ:

overwritten.name.  CNAME  my.domain.
*.overwritten.name.  CNAME  my.domain.
my.domain.  AAAA  2001:db8::1

Or perhaps alternatively

*.overwritten.name.  CNAME  overwritten.name.
overwritten.name.  AAAA  2001:db8::1

[pschichtel]

Yeah that seems to be what I'd need.

[pschichtel]

Is there a tracker-isser/milestone/any form of timeline I can follow?

[vcunat]

Follow when a new version comes out? This mailing list might be the best way:
https://mailman.nic.cz/hyperkitty/list/knot-resolver-announce@lists.nic.cz/

[pschichtel]

@vcunat Since the change you mentioned is exactly what I'd need and I moved the one rule that wasn't supported to dnsmasq, feel free to close this issue as resolved.

[vcunat]

Released weeks ago

Knot Resolver 6.3.0 (2026-04-27)

[NLouvel]

Hi,

I’m seeing a similar regression: wildcard rules in RPZ work on 5.7.4, but no longer work on 6.3.0.

In our case, wildcards are not used with CNAME, but with A and AAAA records.

Would it be possible to extend support for wildcard handling to these DNS record types as well?

RPZ sample:

$TTL 300
@         IN      SOA zone.mydns.fr. root.mydns. (
                                26052919     ; Numero
                                216000    ; Refresh
                                3600    ; Retry
                                3600000     ; Expire
                                172800 )   ; Minimum
@       IN      NS      ns1.mydns.fr.
@       IN      NS      ns2.mydns.fr.
myname.fr		IN      A       127.0.0.1
myname.fr		IN      AAAA       ::1
*.myname.fr		IN      A       127.0.0.1
*.myname.fr		IN      AAAA       ::1

[vcunat]

@NLouvel: as pointed out above, one workaround you can do for now (6.3.0) is e.g.:

$TTL 300
@         IN      SOA zone.mydns.fr. root.mydns. (
                                26052919     ; Numero
                                216000    ; Refresh
                                3600    ; Retry
                                3600000     ; Expire
                                172800 )   ; Minimum
@       IN      NS      ns1.mydns.fr.
@       IN      NS      ns2.mydns.fr.
myname.fr		IN      A       127.0.0.1
myname.fr		IN      AAAA       ::1
*.myname.fr		IN      CNAME   myname.fr

Perhaps let me keep this issue open, as the wildcard support is not complete yet, notably missing *.foo.bar. left hand with non-CNAME types.

[NLouvel]

Thanks for reopening this issue. Would this be a large effort to fix?

I had already considered this workaround, but it’s not really practical for our use case.

We receive RPZ data from a provider, including 27,146 wildcard entries that would need to be rewritten. We really don’t want to patch every RPZ file they send us, especially since they sometimes update the files multiple times per day.

[vcunat]

Probably not large, but currently we have lots of higher-priority tasks in the queue, e.g. triaging security reports.