How to drop all AAAA except one or several domain

[Mosney]

I don't want use IPv6, cause my ISP has a bad route on it. But If I want syncthing's IPv6 discovery to work normal, or something else etc, I should allow single or multi-domain AAAA record query. For convenience, example domain use discovery-v6.syncthing.net, which only have AAAA record. So I do some try at first:

$dnstype=AAAA,dnsrewrite=NXDOMAIN;;
@@||discovery-v6.syncthing.net^$dnstype=AAAA,important

Although it looks wired, I think it should be work with my purpose. But the result is AAAA query for discovery-v6.syncthing.net has still been blocked in reply NXDAMAIN.

After some tests, I found I just need a little edit, it will work properly.

$dnstype=AAAA
@@||discovery-v6.syncthing.net^$dnstype=AAAA,important

Just delete ,dnsrewrite=NXDOMAIN;; at first rule it will work, reply NXDOMAIN for AAAA query but discovery-v6.syncthing.net. Even I add important on 2nd rule.

So I think the question is: Why important can't give 2nd rule more high priority than 1st rule?

[ainar-g]

The dnsrewrite rules have higher priority than any other rules, so the syntax here is a bit weird. Normally, to remove the dnsrewrite stuff, you'd simply write:

||example.com^$dnsrewrite

Without the @@. But to remove the dnstype modifier, which does not have the priority boost of the dnsrewrite one, you do need an exception rule:

@@||example.com^$dnstype=AAAA

So, in your case, you need to remove both the dnstype modifier with an exception rule, and the dnsrewrite one with an empty modifier:

 @@||discovery-v6.syncthing.net^$dnstype=AAAA,dnsrewrite

This works in our test setups.

---

@ameshkov, do we want an extra block in the Wiki about such combinations? Is this even the desired behaviour?

[Mosney]

So, in your case, you need to remove both the dnstype modifier with an exception rule, and the dnsrewrite one with an empty modifier:

 @@||discovery-v6.syncthing.net^$dnstype=AAAA,dnsrewrite

I try only use this single rule, it looks same as no rule, either discovery-v6.syncthing.net or other general AAAA query will pass. But I want block other general AAAA query to avoid IPv6 route.

[ainar-g]

That is the modification of the second rule, not the full ruleset. Your full ruleset would be something like:

*$dnstype=AAAA
@@||discovery-v6.syncthing.net^$dnstype=AAAA,dnsrewrite

[Mosney]

1. Rresult is all blocked inclue discovery-v6.syncthing.net (That two rules are what you said above.)

*$dnstype=AAAA
@@||discovery-v6.syncthing.net^$dnstype=AAAA,dnsrewrite

2. Rresult is all blocked exclue discovery-v6.syncthing.net (Match my original needs.)

*$dnstype=AAAA
@@||discovery-v6.syncthing.net^$dnstype=AAAA,important

3. Rresult is all blocked inclue discovery-v6.syncthing.net

*$dnstype=AAAA
@@||discovery-v6.syncthing.net^$dnstype=AAAA,dnsrewrite,important

I'm confused.
If dnsrewrite has priority boost, why 1 not as expect?
If important has highest priority, why 2 work but 3 don't work?

[DandelionSprout]

I would've tried out *$dnstype=AAAA,domain=~syncthing.net

[Mosney]

I think something wrong here, maybe a bug? I try this one but all AAAA query will pass, not only *.syncthing.net.

[ameshkov]

I am sorry that it took us so long to supply the valid answer, but here it is:

$dnstype=AAAA,denyallow=example.org|example.com,dnsrewrite=NXDOMAIN;;

This rule will make AdGuard Home return NXDOMAIN to queries for all domains save for example.org and example.com.

There's one more thing to it. Ideally, the rule should look like this:
$dnstype=AAAA,denyallow=example.org|example.com,dnsrewrite=NOERROR;;

The problem is that AGH currently does not support rewrites to empty "NOERROR" responses. I'll open a bug report about it.

[Mosney]

Very appreciate for your anwser, it work!

[EugeneOne1]

@Mosney, we've got an update. Latest edge build now allows specifying the empty "NOERROR" $dnsrewrite rules. You may try it already or wait for v0.107.3.

We've also improved the wiki page about rewrites so that it now includes this exact case as an example.

[Mosney]

Got it, thanks