Use CoreDNS as a Whitelist/Allowlist filter

[calwalker1]

Hi All,
I have a niche use-case coming up where I need to use CoreDNS as a 'poor-mans' firewall to prevent some devices from accessing any services apart from 1 domain on the internet. Currently the plan is have everything resolve to NXDOMAIN apart from forwarding whatever my 'permitted' domain is. (I understand this will not prevent someone bypassing the DNS. It is merely to prevent certain devices from 'phoning home'

it looks like in FORWARD there is an option for "except" but this is kind of the opposite of what I need. I need to go "ONLY". Alternatively is there information on the order in which CoreDNS processes the CoreFile? Could I have it reply NXDOMAIN to anything that doesn't match the permitted domain, and then all remaining domains (which therefore must be permitted) to 8.8.8.8.

To make things more challenging we'd be looking at allowing approx 20-30 domains including subdomains.

[chrisohaver]

You could list the domains in the server block.

example1.com example2.com {
  forward . 8.8.8.8
}

. {
  [ use template plugin for NXDOMAIN response ]
}

[calwalker1]

Hi this is an excellent idea that seems to work well. I hadn't considered having multiple DNS responders and just having the first one only affect relevant domains.