False Positive: Entire *.a01.azurefd.net zone blocked in gambling.rpz.ipfire.org (Core-Update 203)

IPFire Version: 2.29 (x86_64) - Core-Update 203

Affected Component: DNS Firewall (kresd / RPZ)

Upstream List: gambling.rpz.ipfire.org

Blocked Target: *.a01.azurefd.net (Microsoft Azure Front Door CDN)

Issue Summary

Legitimate websites relying on Microsoft Azure Front Door CDN (such as Nova Scotia Power - www.nspower.ca) fail to resolve and return NXDOMAIN when the DNS Firewall Gambling category is enabled.

Root Cause

The www.nspower.ca CNAME chain routes through an Azure Front Door pool:

www.nspower.ca → fd-nsp-ddgwb8gra7hqf7dg.a01.azurefd.netmr-a01.tm-azurefd.net

Searching the active RPZ zone files under /var/lib/knot-resolver/zones/ revealed that the entire *.a01.azurefd.net domain is wildcard-blocked inside gambling.rpz.ipfire.org.zone.

Evidence / Log Excerpt

[root@ipfire ~]# grep -rn "a01.azurefd.net" /var/lib/knot-resolver/zones/
/var/lib/knot-resolver/zones/gambling.rpz.ipfire.org.zone:465836:a01.azurefd.net.gambling.rpz.ipfire.org. CNAME .
/var/lib/knot-resolver/zones/gambling.rpz.ipfire.org.zone:465837:*.a01.azurefd.net.gambling.rpz.ipfire.org. CNAME .

Impact

Because a01.azurefd.net is a shared global CDN domain managed by Microsoft, listing *.a01.azurefd.net as a gambling site causes widespread false positives for any business hosting public web endpoints on Azure Front Door cluster a01.

Requested Action

Please remove a01.azurefd.net and *.a01.azurefd.net from the upstream gambling.rpz.ipfire.org source list.

Here’s the mechanism to request the desired change …

Submitted a report:

This has been approved.

Thanks for your report, Paul.