Skip to content

OX Feed RPZ Downloader

The PowerDNS Platform Filter OX Feed RPZ Downloader (pdns-pf-oxfeed-rpz-downloader) pulls a Response Policy Zone from an upstream DNS server using AXFR / IXFR, converts the resulting CNAME records into the OX Feed CSV format, and writes a versioned OX Feed (snapshots, deltas, feed-codes.json, feed.json) to a local feed tree.

The service is shipped as a systemd template unit (pdns-pf-oxfeed-rpz-downloader@<instance>.service). One instance is configured per upstream zone — for example one for Spamhaus DROP and another for a custom block list — by copying the example config and symlinking the template unit.

What it does

  • Runs an *XFR query against feed.rpz_downloader.address every feed.rpz_downloader.interval. The first query after startup is always AXFR; subsequent queries are IXFR until feed.rpz_downloader.axfr_interval forces a fresh AXFR.
  • Optionally signs and verifies queries with TSIG.
  • Translates the CNAME records returned by the upstream into OX Feed classification codes (NXDOMAIN, NODATA, PASSTHRU, DROP, TCP_ONLY, LOCAL_DATA).
  • Writes each accepted XFR as a delta (and forces a fresh snapshot every feed.snap_interval) under the configured feed.root.
  • Expires old snapshots and deltas according to the feed.expiry rules, while always preserving the deltas on the upgrade path from the latest snapshot to the latest delta.
  • Exposes status, healthz, and Prometheus metrics over HTTP. Optionally serves the feed tree on /feed for development.

Where it fits in Platform Filter

The RPZ downloader sits at the producer end of the OX Feed pipeline. The feed tree it writes is served to downstream consumers by a static HTTP server (Caddy or nginx), optionally through an OX Feed Mirror for bandwidth fan-out, and consumed by OX Feed Client instances on the filter nodes.

See Architecture for the *XFR loop, the CNAME-to-OX Feed translation, and the snapshot/delta lifecycle.

Next steps

  • Architecture: the *XFR loop, AXFR vs IXFR selection, CNAME-to-code translation, and how snapshots and deltas are written.
  • Configuration: full YAML reference for a per-instance config file.
  • Operations: the systemd template unit, CLI flags, HTTP server, and healthz checks.
  • Metrics: Prometheus metric reference.