I've setup a linux box where there's a BIND that serves me as a local dns.

Basically by taking advantage of RPZ I can restrict some hosts and at same time with DNSCRYPT I forward everything to OpenDNS to get my DNS results.

This works pretty fine..

inside my /etc/bind/named.conf.options i have:

 forwarders {
       port 5353;    };

Where the daemon on 5353 is basically DNSCRYPT listening for forward out to OpenDNS my requests.


It seems however that I have some big issues with CDNs / servers that use anycast IP addresses or that plays around with geolocalization for speedup their functioning.

To list some:

  • wetransfer (that recently uses amazon aws)
  • cloudflare
  • amazon aws

All of these services with the exception of storage.googleapis.com considerably slow down respect of what they are in terms of bandwidth compared to when I connect my machine directly to the fiber modem.


I started to believe that the cause creating this problem is given by the fact that OpenDNS that ultimately makes the request is located somewhere else respect my location so if we ask for an anycast.

Services that make use of Amazon AWS S3 Storage like Wetransfer still works but probably I end up using servers outside normal peering range and you tends to use EU or ASIA servers if you are in US or US servers if you are in EU or ASIA and so on.

This increases the ping but also you take a longer path with a lower bandwidth granted.

In my example I tested s3-us-west-1.amazonaws.com with the OpenDNS check tool. As you can see that DNS behave very differently pointing to different servers depending on the location where you reside.

OpenDNS DNS Check


Because the fibre modem of my provider have it's internal DNS server and resolve a cname like s3-us-west-1.amazonaws.com picking the best server in terms of bandwidth a geographical distance, I would like to forward all the *.amazonaws.com queries to instead of the DNSCRYPT one..

For every other domain i would like to use:

forwarders {
       port 5353;    };

But If domain is inside *.amazonaws.com, *.cloudflare.com, *.wetransfer.com .. instead use:

forwarders {
       port 53;    };

So the question is:

Could this being specified in some way inside with the RPZ files ? And how ?


edit: maybe i found a solution on a reddit thread - i put it here in order to check it later

   options {
            // ... lots of other stuffs

            // forward all queries to google dns
            forward only;
            forwarders {
          ; // google-public-dns-a.google.com.
          ; // google-public-dns-b.google.com.

            // ... lots of other stuffs

    zone "akamai.com" IN {
            type forward;
            forward only;
            forwarders {
          ; // comcast ISP DNS
  • Obviously the price to pay for such setups is messing up with CNAs. Due to their nature, I doubt we will get a reliable way of bypassing that with RPZs, but could be wrong. You can always try to make forwarding of specific domains outside of dnsproxy if you have a few exceptions. Whether you want to complicate your DNS setup, or live up with the DNS geolocation limitations, it will be a tradeoff you will have to think about. Google also has DNScrypt in the, that could be a possible solution if you are willing to outsource to Google. – Rui F Ribeiro Nov 12 '18 at 12:15
  • @RuiFRibeiro "You can always try to make forwarding of specific domains outside of dnsproxy if you have a few exceptions." It's exactly what I want to achieve, but I don't know the syntax. Can you help me? 2-3 exceptions are enough for me: cloudflare, wetransfer and amazonaws. – user3450548 Nov 13 '18 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.