What does CNAME . mean in an RPZ zone?

In RPZ syntax, pointing a domain to `CNAME .` forces the resolver to return an NXDOMAIN (Non-Existent Domain) status code to the client.

Updated: August 2026 • Verified v1.2

DNS RPZ (Response Policy Zone) Firewall Rule Generator

Internet & NetworkNew

Local Browser Execution: Your input is processed locally in your browser and is not sent to UTL servers.

RPZ Record = <domain> IN CNAME <rpz-action-target>

Was this calculation helpful?

Understanding Your Results

Outputs syntactically valid RPZ zone entries (e.g. evil.com CNAME .) and resolver configuration blocks (named.conf response-policy).

Practical Guidance & Next Steps

CNAME . generates NXDOMAIN (domain does not exist), CNAME *. generates NODATA, CNAME rpz-passthru. creates an allowlist exception, and CNAME rpz-drop. discards queries silently.

What is this?

A network security tool that generates DNS Response Policy Zone (RPZ) zone records and BIND/PowerDNS configurations.

How does it work?

1. Enter the target domain or IP subnet to filter. 2. Choose policy action: NXDOMAIN, NODATA, PASSTHRU, DROP, or Walled Garden Redirect. 3. Copy the generated zone file record and named.conf response-policy block.

Why use it?

Enables SecOps teams to intercept malware, ransomware C2, and phishing domains at the recursive resolver before IP connections occur.

Technical Scope & Calculation Limitations

Conforms to RFC/ISC RPZ specification. Specific recursive DNS implementations may require custom tuning.

Frequently Asked Questions

RPZ is a DNS firewall mechanism that allows recursive DNS resolvers to customize responses based on local security policies and threat intelligence feeds.

Windows Desktop & Widget Options