Using RPZ with hashed domains (SHA1) in PowerDNS Recursor

[atakangemici]

Hi,

I'm trying to implement a custom domain filtering mechanism using PowerDNS Recursor and RPZ.

My current approach is:

• Incoming DNS queries are intercepted using a Lua script (preresolve)
• The requested domain (dq.qname) is converted into a SHA1 hash
• I maintain a large list of SHA1 hashes (instead of plain domains)
• I want to match these hashes against an RPZ zone to decide whether to block the request

What I want to achieve
Instead of storing plain domains in RPZ, I want to:

• Store SHA1 hashes as RPZ entries
• Perform a lookup using the computed hash
• If a match is found → let RPZ handle blocking (e.g., return NXDOMAIN or redirect)
• If not → continue normal resolution

My questions

1. Is it possible to query an RPZ zone dynamically from Lua using a computed value (like SHA1)?
2. Can RPZ work with non-domain keys (like hashed values), or does it strictly require valid DNS names?
3. Is there a recommended pattern in PowerDNS for doing this kind of hash-based filtering at scale?

Additional context

• I want to avoid returning responses directly via addAnswer
• The decision should ideally be driven by RPZ policy

Any guidance or best practices would be appreciated.

Thanks!

[omoerbeek]

Hello, sorry it took a while to answer this.

We are pondering a way to introduce a Lua hook to transform a name and use the results to do an RPZ lookup. In that way, the name based logic of RPZ handling does not change and does not have to be partly rewritten in Lua. Effectively, if configured to do so, the RPZ lookup wil be done using myLuaTransform(name) instead of name.

Note that labels can contains binary values. But for readability of (debug) logs it probably is preferabele to use a hex or some other string encoding of the hash value.

Not this is only an initial sketch of how it might work, no decision has been made if and how we will approach this feature request.