On Mon, Sep 04, 2017 at 04:01:06PM +0200, W.C.A. Wijngaards wrote: > This version blocks .test and .invalid by default. I see that the default local-zone type for these is "static", which will look bogus to downstream validating resolvers. Perhaps "refuse" would have been a better choice? Of course one might argue that such resolvers should not have leaked queries for ".invalid" and ".test" upstream... -- Viktor.