{"id":26215,"date":"2024-06-06T14:04:41","date_gmt":"2024-06-06T14:04:41","guid":{"rendered":"https:\/\/blog.lacnic.net\/?p=26215"},"modified":"2024-09-23T14:45:25","modified_gmt":"2024-09-23T14:45:25","slug":"using-dns-for-website-blocking","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/","title":{"rendered":"Using DNS for Website Blocking"},"content":{"rendered":"\n

By Hugo Salgado<\/a>, DNS Architect at Tucows Domains<\/p>\n\n\n\n

DNS (Domain Name System) blocking is a technique used by network administrators at companies, organizations, and Internet Service Providers (ISPs) to restrict access to certain websites and protect users from inappropriate or malicious content.<\/p>\n\n\n\n

In response to suggestions made by participants who completed the course offered by the LACNIC Campus<\/a>, DNS blocking was included in the LACNIC 41 agenda<\/a>, where we stressed how it can be implemented to protect users against potentially malicious websites (malware, phishing, etc.), for family and parental controls, and for meeting certain legal requirements.<\/p>\n\n\n\n

Network filtering, a common practice on today’s Internet, often uses DNS blocking. DNS blocking can be broad (blocking websites, email, messaging, etc.), a block on an entire domain (URLs cannot be differentiated), or more complex when legitimate services are affected (for instance, if a website is partially hacked, the \u201clegitimate\u201d portion is also blocked).<\/p>\n\n\n\n

Our presentation included Response Policy Zone (RPZ), a tool that is very easy to use. This technology is utilized by network administrators to implement DNS response policies. RPZs allow administrators to modify DNS query responses for the purpose of blocking, redirecting, or interrupting access to certain domains. Although it has not yet been formally standardized, this technology is already implemented in well-known open-source DNS systems, and a specification is available on the dnsrpz.info<\/a> website. The presentation demonstrated an example of its operation and shared instructions for activating RPZ in BIND.<\/p>\n\n\n

Leer tambi\u00e9n:<\/div><\/div><\/div>
How LACNIC Contributes to DNS Resilience<\/a><\/div><\/div><\/section>\n\n\n

RPZ is a very useful tool that is configured in resolvers. When a client queries a name that matches a pattern, the response is rewritten, preventing the user from reaching a blocked website.<\/p>\n\n\n\n

What blocking patterns can be used?<\/strong> Once RPZ is configured, queries to domains or IP addresses can be blocked or redirected based on the policies defined by the carrier or the ISP. Blocks can be implemented based on queried names (exact match or an entire subdomain), name servers (i.e., the server providing the response), an IP address\/range in the response, or a client’s IP address.<\/p>\n\n\n\n

RPZ can be configured so that end clients receive an error response (\u201cUnable to access the site\u201d) or are redirected to the ISP’s own portal where they are offered more information and warned about the risks of proceeding to the site.<\/p>\n\n\n\n

It\u2019s possible to have different \u201czones\u201d with different RPZ rules, each potentially managed by different units within the organization. Another option is to use external zones maintained by third parties. In other words, different sources are used to implement the blocks.<\/p>\n\n\n\n

The image below shows a typical architecture for using RPZ in an organization’s networks.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In the future, it would be interesting to standardize the RPZ technique within the IETF, and for national CERTs or CSIRTs to provide lists in RPZ format of sites or addresses that might represent potential threats.<\/p>\n\n\n\n

Finally, it should be noted that any block within an organization should be carefully considered and must follow all relevant policies and legislation. DNS blocking should consider issues such as net neutrality, censorship, freedom of expression, and its collateral impact on legitimate sites.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Hugo Salgado, DNS Architect at Tucows Domains DNS (Domain Name System) blocking is a technique used by network administrators at companies, organizations, and Internet Service Providers (ISPs) to restrict access to certain websites and protect users from inappropriate or malicious content. In response to suggestions made by participants who completed the course offered by […]<\/p>\n","protected":false},"author":6,"featured_media":26204,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1321],"tags":[1271,416],"archivo":[1345,1451],"taxonomy-authors":[1239],"tipo_autor":[1455],"class_list":["post-26215","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dns-en","tag-cibersecurity","tag-dns-en","archivo-editions","archivo-highlights-2023","taxonomy-authors-hugo-salgado-en","tipo_autor-colaborador"],"acf":{"author":"Hugo Salgado, DNS Architect at Tucows Domains","related_notes":""},"yoast_head":"\nLACNIC Blog | Using DNS for Website Blocking<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LACNIC Blog | Using DNS for Website Blocking\" \/>\n<meta property=\"og:description\" content=\"By Hugo Salgado, DNS Architect at Tucows Domains DNS (Domain Name System) blocking is a technique used by network administrators at companies, organizations, and Internet Service Providers (ISPs) to restrict access to certain websites and protect users from inappropriate or malicious content. In response to suggestions made by participants who completed the course offered by […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/\" \/>\n<meta property=\"og:site_name\" content=\"LACNIC Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/facebook.com\/lacnic\" \/>\n<meta property=\"article:published_time\" content=\"2024-06-06T14:04:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-09-23T14:45:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png\" \/>\n\t<meta property=\"og:image:width\" content=\"680\" \/>\n\t<meta property=\"og:image:height\" content=\"330\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Gianni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@lacnic\" \/>\n<meta name=\"twitter:site\" content=\"@lacnic\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/\"},\"author\":{\"name\":\"Gianni\",\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab\"},\"headline\":\"Using DNS for Website Blocking\",\"datePublished\":\"2024-06-06T14:04:41+00:00\",\"dateModified\":\"2024-09-23T14:45:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/\"},\"wordCount\":526,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/blog.lacnic.net\/#organization\"},\"image\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png\",\"keywords\":[\"Cibersecurity\",\"DNS\"],\"articleSection\":[\"DNS\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/\",\"url\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/\",\"name\":\"LACNIC Blog | Using DNS for Website Blocking\",\"isPartOf\":{\"@id\":\"https:\/\/blog.lacnic.net\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png\",\"datePublished\":\"2024-06-06T14:04:41+00:00\",\"dateModified\":\"2024-09-23T14:45:25+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#primaryimage\",\"url\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png\",\"contentUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png\",\"width\":680,\"height\":330},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\/\/blog.lacnic.net\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Using DNS for Website Blocking\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.lacnic.net\/#website\",\"url\":\"https:\/\/blog.lacnic.net\/\",\"name\":\"LACNIC Blog\",\"description\":\"En el Blog de LACNIC encontrar\u00e1s art\u00edculos t\u00e9cnicos vinculados al desarrollo de Internet en la regi\u00f3n de Am\u00e9rica Latina y el Caribe.\",\"publisher\":{\"@id\":\"https:\/\/blog.lacnic.net\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.lacnic.net\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/blog.lacnic.net\/#organization\",\"name\":\"LACNIC Blog\",\"url\":\"https:\/\/blog.lacnic.net\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg\",\"contentUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg\",\"caption\":\"LACNIC Blog\"},\"image\":{\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/facebook.com\/lacnic\",\"https:\/\/x.com\/lacnic\",\"https:\/\/www.instagram.com\/lacnic\/?hl=es-la\",\"https:\/\/uy.linkedin.com\/company\/lacnic\",\"https:\/\/www.youtube.com\/user\/lacnicstaff\",\"https:\/\/www.lacnic.net\/podcast\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab\",\"name\":\"Gianni\",\"url\":\"https:\/\/blog.lacnic.net\/en\/author\/gianni\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LACNIC Blog | Using DNS for Website Blocking","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/","og_locale":"en_US","og_type":"article","og_title":"LACNIC Blog | Using DNS for Website Blocking","og_description":"By Hugo Salgado, DNS Architect at Tucows Domains DNS (Domain Name System) blocking is a technique used by network administrators at companies, organizations, and Internet Service Providers (ISPs) to restrict access to certain websites and protect users from inappropriate or malicious content. In response to suggestions made by participants who completed the course offered by […]","og_url":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/","og_site_name":"LACNIC Blog","article_publisher":"https:\/\/facebook.com\/lacnic","article_published_time":"2024-06-06T14:04:41+00:00","article_modified_time":"2024-09-23T14:45:25+00:00","og_image":[{"width":680,"height":330,"url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png","type":"image\/png"}],"author":"Gianni","twitter_card":"summary_large_image","twitter_creator":"@lacnic","twitter_site":"@lacnic","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#article","isPartOf":{"@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/"},"author":{"name":"Gianni","@id":"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab"},"headline":"Using DNS for Website Blocking","datePublished":"2024-06-06T14:04:41+00:00","dateModified":"2024-09-23T14:45:25+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/"},"wordCount":526,"commentCount":0,"publisher":{"@id":"https:\/\/blog.lacnic.net\/#organization"},"image":{"@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png","keywords":["Cibersecurity","DNS"],"articleSection":["DNS"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/","url":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/","name":"LACNIC Blog | Using DNS for Website Blocking","isPartOf":{"@id":"https:\/\/blog.lacnic.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#primaryimage"},"image":{"@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png","datePublished":"2024-06-06T14:04:41+00:00","dateModified":"2024-09-23T14:45:25+00:00","breadcrumb":{"@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#primaryimage","url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png","contentUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png","width":680,"height":330},{"@type":"BreadcrumbList","@id":"https:\/\/blog.lacnic.net\/en\/using-dns-for-website-blocking\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/blog.lacnic.net\/en\/"},{"@type":"ListItem","position":2,"name":"Using DNS for Website Blocking"}]},{"@type":"WebSite","@id":"https:\/\/blog.lacnic.net\/#website","url":"https:\/\/blog.lacnic.net\/","name":"LACNIC Blog","description":"En el Blog de LACNIC encontrar\u00e1s art\u00edculos t\u00e9cnicos vinculados al desarrollo de Internet en la regi\u00f3n de Am\u00e9rica Latina y el Caribe.","publisher":{"@id":"https:\/\/blog.lacnic.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.lacnic.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/blog.lacnic.net\/#organization","name":"LACNIC Blog","url":"https:\/\/blog.lacnic.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/","url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg","contentUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg","caption":"LACNIC Blog"},"image":{"@id":"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/facebook.com\/lacnic","https:\/\/x.com\/lacnic","https:\/\/www.instagram.com\/lacnic\/?hl=es-la","https:\/\/uy.linkedin.com\/company\/lacnic","https:\/\/www.youtube.com\/user\/lacnicstaff","https:\/\/www.lacnic.net\/podcast"]},{"@type":"Person","@id":"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab","name":"Gianni","url":"https:\/\/blog.lacnic.net\/en\/author\/gianni\/"}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2024\/06\/dns-bloque-2024-blog-lacnic.png","jetpack_sharing_enabled":true,"wpml_current_locale":"en_US","wpml_translations":[{"locale":"es_ES","id":26201,"post_title":"Uso del DNS para bloqueo de sitios","slug":"uso-del-dns-para-bloqueo-de-sitios","href":"https:\/\/blog.lacnic.net\/uso-del-dns-para-bloqueo-de-sitios\/"},{"locale":"pt_BR","id":26218,"post_title":"Uso do DNS para bloqueio de sites","slug":"uso-do-dns-para-bloqueio-de-sites","href":"https:\/\/blog.lacnic.net\/pt-br\/uso-do-dns-para-bloqueio-de-sites\/"}],"_links":{"self":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/26215","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/comments?post=26215"}],"version-history":[{"count":3,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/26215\/revisions"}],"predecessor-version":[{"id":27302,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/26215\/revisions\/27302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/media\/26204"}],"wp:attachment":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/media?parent=26215"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/categories?post=26215"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/tags?post=26215"},{"taxonomy":"archivo","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/archivo?post=26215"},{"taxonomy":"taxonomy-authors","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/taxonomy-authors?post=26215"},{"taxonomy":"tipo_autor","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/tipo_autor?post=26215"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}