Last Modified: Jul 28, 2026
Affected Product(s):
BIG-IP DNS
Known Affected Versions:
21.1.0, 21.1.0.1
Opened: May 29, 2026 Severity: 3-Major
A client’s DNS query that travels through a BIG-IP DNS cache to an upstream authoritative server will not be evaluated against RPZ policies if the server returns a SERVFAIL response
It might be difficult to create RPZ policy configurations that effectively process negative DNS responses from upstream
A DNS cache configuration, whether through a resolver or a transparent setup, can utilize RPZ (Response Policy Zone) policies to block or modify DNS responses. However, if a client's DNS query matches an RPZ policy based on the client's IP address or the QNAME trigger, and the DNS server responds with a SERVFAIL message, the RPZ policy will be ignored. As a result, the client will receive a SERVFAIL response, even if the RPZ policy specifies that queries from this client IP or for this QNAME should lead to a specific RPZ-generated response
If the specific QNAMEs yielding the SERVFAILs from upstream are limited and known beforehand, the cache can be configured with local zone records for them, obviating the need to send out the query to the upstream server, and then RPZ will be applied normally based on the response obtained from the local zone. This is, however, not practical for large and unpredictable domain sets
None