Why aren’t our DNS records propagating out into the internet

The best method is via the response policy zone in Bind 9.8.1 or newer. It allows you to override single records in arbitrary zones (and there's no need to create a whole subdomain for that, only the single record you want to change), it allows you to override CNAMEs, etc. Other solutions such as Unbound cannot override CNAMEs.

https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html

EDIT: Let's do this properly then. I will document what I've done based on the tutorial linked above.

My OS is Raspbian 4.4 for Raspberry Pi, but the technique should work without any changes on Debian and Ubuntu, or with minimal changes on other platforms.

Go to where your Bind config files are kept on your system - here it's in /etc/bind. Create in there a file called db.rpz with the following contents:

$TTL 60
@            IN    SOA  localhost. root.localhost.  (
                          2015112501   ; serial
                          1h           ; refresh
                          30m          ; retry
                          1w           ; expiry
                          30m)         ; minimum
                   IN     NS    localhost.

localhost       A   127.0.0.1

www.some-website.com    A        127.0.0.1

www.other-website.com   CNAME    fake-hostname.com.

What does it do?

• it overrides the IP address for www.some-website.com with the fake address 127.0.0.1, effectively sending all traffic for that site to the loopback address
• it sends traffic for www.other-website.com to another site called fake-hostname.com

Anything that could go in a Bind zone file you can use here.

To activate these changes there are a few more steps:

Edit named.conf.local and add this section:

zone "rpz" {
  type master;
  file "/etc/bind/db.rpz";
};

The tutorial linked above tells you to add more stuff to zone "rpz" { } but that's not necessary in simple setups - what I've shown here is the minimum to make it work on your local resolver.

Edit named.conf.options and somewhere in the options { } section add the response-policy option:

options {
  // bunch
  // of
  // stuff
  // please
  // ignore

  response-policy { zone "rpz"; };
}

Now restart Bind:

service bind9 restart

That's it. The nameserver should begin overriding those records now.

If you need to make changes, just edit db.rpz, then restart Bind again.

Bonus: if you want to log DNS queries to syslog, so you can keep an eye on the proceedings, edit named.conf.local and make sure there's a logging section that includes these statements:

logging {
    // stuff
    // already
    // there

    channel my_syslog {
        syslog daemon;
        severity info;
    };
    category queries { my_syslog; };
};

Restart Bind again and that's it.

Test it on the machine running Bind:

dig @127.0.0.1 www.other-website.com. any

If you run dig on a different machine just use @the-ip-address-of-Bind-server instead of @127.0.0.1

I've used this technique with great success to override the CNAME for a website I was working on, sending it to a new AWS load balancer that I was just testing. A Raspberry Pi was used to run Bind, and the RPi was also configured to function as a WiFi router - so by connecting devices to the SSID running on the RPi I would get the DNS overrides I needed for testing.

Myth? Kind of.

There are 2 aspects that people often confuse. If you make a change to your domain name with your domain name registrar, for example changing the name servers, that is pushed to the name servers for your TLD (.com, .ca, .fr, etc). That's where the propagation comes into play. In years past, that could take hours or even days waiting for the registrar to take the information you provided, push that to their deployment servers which would update the TLD root servers twice per day. That's improved rapidly over the years and often times changes made to your domain name take take effect nearly immediately.

On the other hand, if you make a change to your DNS zone, like adding an A record or an MX change, that should take 'up to' as long as the TTL setting to be updated everywhere. That's not really propagation though, it's caching. Microsoft DNS, for example, defaults to 1 hour TTL.

With the caching, if you happen to use the domain name just before making a change, and the TTL is 1 hour, then it will take an hour for it to be updated. However, if you haven't tested anything with the domain name just prior to the change, then your change will be immediate for you. (i.e. add a new A record that you haven't tested with yet, and it will take effect immediately).

So, nowadays almost all changes will take affect within an hour (or whatever your DNS TTL is set for). The only exceptions are if a DNS server doesn't honor the TTL (spammers often don't), or if your domain name registrar's servers aren't updating properly to the internet and you make a registrar level change. That isn't often though.