News for hackers. Stuff that matters.

A comment on Blocklist Facebook domains. Parent comment

Re:Blocklist Facebook domains by rbritton on Tuesday March 20, 2018 @05:56PM (#16633094)
You could sort of work around that by just blocking their IP ranges:

https://stackoverflow.com/a/11164738

[ Parent | on HN ]
Re:Blocklist Facebook domains by topranks on Tuesday March 20, 2018 @06:03PM (#16633146)
The ranges could change over time.

If you run your own DNS resolver you can use the wildcard trick.

Something like this in an RPZ zone should do it:

    facebook.com    IN CNAME .
    *.facebook.com  IN CNAME .
    facebook.net    IN CNAME .
    *.facebook.net  IN CNAME .
    fbcdn.com       IN CNAME .
    *.fbcdn.com     IN CNAME .
    fbcdn.net       IN CNAME .
    *.fbcdn.net     IN CNAME .
    fb.com          IN CNAME .
    *.fb.com        IN CNAME .
    fb.me           IN CNAME .
    *.fb.me         IN CNAME .
    tfbnw.com       IN CNAME .
    *.tfbnw.com     IN CNAME .
[ Parent | on HN ]
Re:Blocklist Facebook domains by zaarn on Wednesday March 21, 2018 @03:52AM (#16636271) 

    *.facebook.com IN CNAME .
should be unnecessary since the DNS zone above it, facebook.com is already CNAME'd. Most resolvers will take a CNAME as "any further requests go to here", which to my experience usually includes NS servers.

(This is also why you don't CNAME your root domain, CNAME conflicts with any other record type)

[ Parent | on HN ]