IPFire Version: 2.29 (x86_64) - Core-Update 203
Affected Component: DNS Firewall (kresd / RPZ)
Upstream List: gambling.rpz.ipfire.org
Blocked Target: *.a01.azurefd.net (Microsoft Azure Front Door CDN)
Issue Summary
Legitimate websites relying on Microsoft Azure Front Door CDN (such as Nova Scotia Power - www.nspower.ca) fail to resolve and return NXDOMAIN when the DNS Firewall Gambling category is enabled.
Root Cause
The www.nspower.ca CNAME chain routes through an Azure Front Door pool:
www.nspower.ca → fd-nsp-ddgwb8gra7hqf7dg.a01.azurefd.net → mr-a01.tm-azurefd.net
Searching the active RPZ zone files under /var/lib/knot-resolver/zones/ revealed that the entire *.a01.azurefd.net domain is wildcard-blocked inside gambling.rpz.ipfire.org.zone.
Evidence / Log Excerpt
[root@ipfire ~]# grep -rn "a01.azurefd.net" /var/lib/knot-resolver/zones/
/var/lib/knot-resolver/zones/gambling.rpz.ipfire.org.zone:465836:a01.azurefd.net.gambling.rpz.ipfire.org. CNAME .
/var/lib/knot-resolver/zones/gambling.rpz.ipfire.org.zone:465837:*.a01.azurefd.net.gambling.rpz.ipfire.org. CNAME .
Impact
Because a01.azurefd.net is a shared global CDN domain managed by Microsoft, listing *.a01.azurefd.net as a gambling site causes widespread false positives for any business hosting public web endpoints on Azure Front Door cluster a01.
Requested Action
Please remove a01.azurefd.net and *.a01.azurefd.net from the upstream gambling.rpz.ipfire.org source list.