Blocking undesirable domains using BIND

[Maxim Khitrov]

On Dec 28, 2007 11:28 AM, Rob <bitabyss at gmail.com> wrote:
> Kevin Kinsey wrote:
> > Just a question, and I'm not trying to cast doubt on your plan; I'm
> > curious why using BIND for this purpose instead of a proxy, which is
> > a more typical application as I understand it?
>
> I was trying to do something similar.  I didn't research too hard, but figured the only way to use Bind would be to make my server authoritative for all those domains, which meant a huge config file and potential overhead, as well as
> possibly breaking access to desirable servers in the domains.
>
> So hosts seemed easier, but apparently Bind never looks at hosts.  I did find that Squid (which I already had installed and in limited use) has its own DNS resolver, and it does look at hosts first before going to the nameserver.
>
> Then I found this site:  http://everythingisnt.com/hosts.html and put their list in hosts, and now client PCs get a squid error in place of ad junk.  Works ok for me ;)
>
>   -Rob
>

Well... you were right about overhead. In the last two days I wrote a
script that would fetch a list of domains from several different
sites, and output a valid BIND configuration file that could be
included in the main config. I just ran the second test and the
results are extremely poor. With only 27,885 blocked domains the
server is now consuming 208 MB of ram. The first time I tried
reloading the full list of domains (91,137 of them) and that nearly
crashed my server. Had to kill bind, remove two of the largest
sources, and try a second time.

Honestly, I can't figure out what BIND could possibly be using so much
memory for. It's taking up about 7 KB for each zone. The zone file
itself is not even 1 KB, and given that all the records are pointing
to the exact same thing it seems to be needlessly wasting memory. In
addition to that, if I comment out the blacklist config file and run
rndc reload, it only frees up about 16 MB. So it doesn't even release
memory when it is no longer needed.

It looks like my plan of using BIND for filtering purposes will not
work. Given how poorly it performed on this test I'm actually inclined
to try another name server to see if something else would be more
memory-efficient. If I can't find anything then I'll need to put some
other piece of software to intercept BIND's recursive queries and
block the domains that way.

- Max