Zip domains a bad idea

This is a little scary:

see the two GitHub examples about ½ way down.

Time to block all *.zip and *.mov domains?


This maybe easy with proxy
With something like *.zip and *.mov
Any suggestions without proxy?

I don’t have a good answer. But someone is trying to create a list of zip domains and their IP addresses.

This looks like it could be a start for an IPSet list!

1 Like

You can use DNS Forwarding. Just enter zip as zone, something that will never answer as server ( for example), Enable, Disable DNSSEC. Then do the same for mov.

I’m not sure this is a huge problem however, the people vulnerable to this are likely to fall prey to many other “easier” scams, too.

1 Like

IPFire WEB Home/Network/DNS Forwarding

Add there the zip and the mov as new entry
Use for fast response .

1 Like

@trash-trash - can you click on the edit (the pencil) and post a screen shot of the larger firewall rule page? I have a terrible time understanding the mini version of a firewall rules.

Thank you!

1 Like

I don’t think you need a firewall rule for this
They are using the DNS forward tab
so if I understand this right.
Zone = * .zip (* wildcard / anything ).zip
Name server (loop back address will get no response)
generaly the only loop back address used is local host
and apparently an invalid ip so it will work the same? is sometimes all ip’s like * . * . * . * would be

DNSSEC disabled (because not Valid)

Assuming only disables DNSSEC for that domain
so all requests go into loop back black hole.
hope I have this right

I am an idiot!

I’ll look at the DNS Forwarding. I am worried about disabling the DNSSEC (which I don’t want to do!)

Does this need updated? the last bit about “Open console”
can this be done from the WUI
without the manual modifications

maybe (I need to read through it!). If you see something incorrect feel free to add or change.

I tired a few different things with DNS Forward and I get getting

DNS forward configuration

Error messages

Invalid domain name.

Keep in mind I know little to nothing about DNS Forward

1 Like

Perhaps the error is correct.
and the wiki is correct.
you would need to add it threw the console per the wiki
Perhaps Stefan would know.

Hi Jon
Adding zip and mov to DNS Forward works? Or is there any error?
On my side, I had no error and the test result works. I tested others for check function too.

Just type zip into Zone and the IP or IP into Nameservers.
Enabled and Add / Save
Same for mov
No need for DNSSEC because we just block those two top domains. No need for any checks.


All of my tests included wildcards (e.g., *.zip). I give it a try with jus zip. I am curious, what did you do to test this?

EDIT: it looks like this is what is changed (see stub-zone):

[root@ipfireAPU bin] # cat /etc/unbound/forward.conf
# This file is automatically generated and any changes
# will be overwritten. DO NOT EDIT!

	qname-minimisation-strict: yes

	name: zip

	name: "."
	forward-tls-upstream: yes
. . .

As you can see at last screenshot of DNS Forwarding, I just added for tests “com net org” and furthermore of top domains.
Sites that I was not browsing them before I startet the test, ends with no result… timeout.

Remember please, that you computer have IPs in the cache, that need to be cleard. Maybe disconnect network for a short time and reconnect, or reboot the computer where you are testing.

The reason why I do not use at this point, ist that the clients gets no a localhost reference info, so they do not try search further.

Furthermore I tried by a live linux on DVD, to serve some zip sites in an isolatet network … All tests go in time out too.


FYI - with Disable DNSSEC the forward.conf looks like this…

[root@ipfireAPU bin] # cat /etc/unbound/forward.conf
# This file is automatically generated and any changes
# will be overwritten. DO NOT EDIT!

	qname-minimisation-strict: yes

	name: zip

	domain-insecure: zip
	name: "."
	forward-tls-upstream: yes
. . .

Test this please:


on,zip,,block top domain *.zip,off
on,mov,,block top domain *.mov,off

To test any other simply enter an other top domain.
Example to make it easy:
on,com,,block top domain *.com,off
on,net,,block top domain *.net,off


Ok I thinK I under stand why this can and should be
Just "zip"Not * .zip
I am confusing web site address / names with the Domain.
Google .com
“com” is the Domain
My ipfire router is “ipfire.localdomain”
“localdomain” is domain
ipfire is equivalent to Google

So if ihave 2 ipfires with a N2N tunnel
1 named "ipfirehome.shaunhome
2 named "ipfirework.shaunwork

I would add work in the DNS forward to ipfire.shaunhome


You are good, you had good explaind.

My DNS Forward have the info for:

localhost =
ipfire =
localdomain =
local =
My “root ns .” =

Please note: Never use other domainname when you are not the owner! And owner of your own Name Server! Or had set that domain locally to .

At old forum of ipfire org it was explaind excellently.

So if you are not the owner of or etc. do not choose for your Firewall. In some cases you will share informations to that domain. So avoid do so.
Keep using ipfire.localdomain.local this is safe.

Sorry for my bad English.

two correction done to typo.

In this case of your example we take ex. []
www ist the sub domain an web-server and in other words an (( localhost at that maschin ))
google is the domain and in other words the localdomain
com is the top level domain TLD and in other words the local
. is the root name server


1 Like