{"id":50311071,"url":"https://github.com/dimaru/bind9-filter","last_synced_at":"2026-05-28T21:01:09.099Z","repository":{"id":353175946,"uuid":"1155269557","full_name":"DimaRU/bind9-filter","owner":"DimaRU","description":"Selective filtering of AAAA or A records. Plugin for BIND9.","archived":false,"fork":false,"pushed_at":"2026-04-22T18:45:26.000Z","size":29,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-04-22T20:23:44.664Z","etag":null,"topics":["bind9","dns","ipv6-support"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DimaRU.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-02-11T10:16:49.000Z","updated_at":"2026-04-22T18:45:30.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/DimaRU/bind9-filter","commit_stats":null,"previous_names":["dimaru/bind9-filter"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/DimaRU/bind9-filter","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DimaRU%2Fbind9-filter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DimaRU%2Fbind9-filter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DimaRU%2Fbind9-filter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DimaRU%2Fbind9-filter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DimaRU","download_url":"https://codeload.github.com/DimaRU/bind9-filter/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DimaRU%2Fbind9-filter/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33626142,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-28T02:00:06.440Z","response_time":99,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bind9","dns","ipv6-support"],"created_at":"2026-05-28T21:01:03.882Z","updated_at":"2026-05-28T21:01:09.080Z","avatar_url":"https://github.com/DimaRU.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# BIND9 conditional filter\n\nFilter AAAA or A in DNS responses based on domain name.\n\n## Getting Started\n\n### Sample configuration\n\n```bind9\nplugin query \"filter-a-cond.so\" {\n   filter-a-on-v6 yes;\n   filter-a-on-v4 yes;\n   filter-a { any; };\n   only-for-domains { \"youtube.com.\"; \"youtu.be.\"; \"accounts.youtube.com\"; \"i.ytimg.com.\"; \"wide-youtube.l.google.com.\"; \"www3.l.google.com.\"; \"clients.l.google.com.\"; \"yt3.googleusercontent.com.\"; \"googlevideo.com.\"; \"accounts.google.com.\"; \"youtube-ui.l.google.com.\"; };\n};\n\nplugin query \"filter-aaaa-cond.so\" {\n   filter-aaaa-on-v6 yes;\n   filter-aaaa-on-v4 yes;\n   filter-aaaa { any; };\n   only-for-domains_exact { \"www.google.com.\"; };\n};\n```\n\nIn this configuration, we forces youtube run in IPv6 mode. This is particularly important for using IPV6 on the Apple TV set-top box. We also use Google search in IPv4 mode to avoid annoying captchas.\n\n\n### Build\n\nAssumed, that you use stable bind version from BIND9 PPA: \nhttps://launchpad.net/~isc/+archive/ubuntu/bind\n\nUse `docker-build.sh` bash script for building filter plugins for Ubuntu 24.04 \"Noble\"\n```bash\n./docker-build.sh \"9.20.22\"\n```\nBind9 sources downloaded from here: https://ppa.launchpadcontent.net/isc/bind/ubuntu/pool/main/b/bind9/\n\n### Install\n\nAfter build, you will have `filter-aaaa-cond.so` and  `filter-a-cond.so` files in the build directory.\nExecute in terminaL \n`sudo make install`\nto copy files into appopriate directory or\n`sudo make run`\nto copy files into appopriate directory and restart bind9 service.\n\n## Usage\n\n### Synopsis\n\n**plugin query** \"filter-a-cond.so\" [{ parameters }];\n**plugin query** \"filter-aaaa-cond.so\" [{ parameters }];\n\n## **filter-aaaa-cond.so**\n#### Description\n\n**filter-aaaa-cond.so** is a query plugin module for [`named`](https://bind9.readthedocs.io/en/stable/manpages.html#std-iscman-named), enabling [`named`](https://bind9.readthedocs.io/en/stable/manpages.html#std-iscman-named) to omit some IPv6 addresses when responding to clients.\n\n####  Options\n\n**`filter-aaaa`**\n\nThis option specifies a list of client addresses for which AAAA filtering is to be applied. The default is `any`.\n\n**`filter-aaaa-on-v4`**\n\nIf set to `yes`, this option indicates that the DNS client is at an IPv4 address, in `filter-aaaa`. If the response does not include DNSSEC signatures, then all AAAA records are deleted from the response. This filtering applies to all responses, not only authoritative ones.\n\nIf set to `break-dnssec`, then AAAA records are deleted even when DNSSEC is enabled. As suggested by the name, this causes the response to fail to verify, because the DNSSEC protocol is designed to detect deletions.\n\nThis mechanism can erroneously cause other servers not to give AAAA records to their clients. If a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv4, it is denied AAAA records even if its client is using IPv6.\n\n**`filter-aaaa-on-v6`**\n\nThis option is identical to `filter-aaaa-on-v4`, except that it filters AAAA responses to queries from IPv6 clients instead of IPv4 clients. To filter all responses, set both options to `yes`.\n\n**`only-for-domains`**\n\nThis option specifies a list of domains for which AAAA filtering is to be applied. Filtering also applies to all subdomains.\n\n**`only-for-domains_exact`**\n\nThis option specifies a list of domains for which AAAA filtering is to be applied. Domain names specified exactly, so subdomains are not included in the filtering.\n\n## **filter-a-cond.so**\n### Description\n\n**filter-a-cond.so** is a query plugin module for [`named`](https://bind9.readthedocs.io/en/stable/manpages.html#std-iscman-named), enabling [`named`](https://bind9.readthedocs.io/en/stable/manpages.html#std-iscman-named) to omit some IPv4 addresses when responding to clients.\n\nThis module is intended to aid transition from IPv4 to IPv6 by\nwithholding IPv4 addresses from DNS clients which are not connected to\nthe IPv4 Internet, when the name being looked up has an IPv6 address\navailable. Use of this module is not recommended unless absolutely\nnecessary.\n\nNote: This mechanism can erroneously cause other servers not to give A\nrecords to their clients. If a recursing server with both IPv6 and IPv4\nnetwork connections queries an authoritative server using this mechanism\nvia IPv6, it is denied A records even if its client is using IPv4.\n\n### Options\n\n**`filter-a`**\n\nThis option specifies a list of client addresses for which A\nfiltering is to be applied. The default is `any`.\n\n**`filter-a-on-v6`**\n\nIf set to `yes`, this option indicates that the DNS client is at an\nIPv6 address, in `filter-a`. If the response does not include DNSSEC\nsignatures, then all A records are deleted from the response. This\nfiltering applies to all responses, not only authoritative ones.\n\nIf set to **`break-dnssec`**, then A records are deleted even when\nDNSSEC is enabled. As suggested by the name, this causes the\nresponse to fail to verify, because the DNSSEC protocol is designed\nto detect deletions.\n\nThis mechanism can erroneously cause other servers not to give A\nrecords to their clients. If a recursing server with both IPv6 and\nIPv4 network connections queries an authoritative server using this\nmechanism via IPv6, it is denied A records even if its client is\nusing IPv4.\n\n**`filter-a-on-v4`**\n\nThis option is identical to `filter-a-on-v6`, except that it filters\nA responses to queries from IPv4 clients instead of IPv6 clients. To\nfilter all responses, set both options to `yes`.\n\n**`only-for-domains`**\n\nThis option specifies a list of domains for which A filtering is to be applied. Filtering also applies to all subdomains.\n\n**`only-for-domains_exact`**\n\nThis option specifies a list of domains for which A filtering is to be applied. Domain names specified exactly, so subdomains are not included in the filtering.\n\n## License\n\nThis code is licensed under the GNU License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdimaru%2Fbind9-filter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdimaru%2Fbind9-filter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdimaru%2Fbind9-filter/lists"}