<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Is there any specific reason why would you want to block all IDN
domains in your dnsmasq? What attack would you like to prevent?
Can you share examples where this would help?<br>
</p>
<p>I think this is a primary job for domain registrators, which
should prevent registrations of mixed alphabets to prevents
spoofing of selected letters. If they don't, I think it is
possible to block whole TLD where this is allowed. There is no
good solution for dnsmasq to do such thing. I think it should not
be done on client side and especially not this way. I would
recommend using RPZ driven blocklist in bigger resolver, which
would block only known bad sites.<br>
</p>
<div class="moz-cite-prefix">On 5/11/23 04:12, B@us wrote:<br>
</div>
<blockquote type="cite"
cite="mid:00a401d983ae$10e82de0$32b889a0$@burtonstrauss.us">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
font-variant:normal !important;
color:windowtext;
text-transform:none;
font-weight:normal;
font-style:normal;
text-decoration:none none;
vertical-align:baseline;}.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">I realize this breaks many standards. But
the reality for most small installations is we have no real
business visiting sites with non-ASCII domain names. I’m
thinking of protecting against the Greek “α” which looks a lot
like the letter “a”.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is there an easy way to translate domains
that don’t match \.[A-Za-z0-9]\. to 127.0.0.1?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks!</p>
</div>
</blockquote>
<pre class="moz-signature" cols="72">--
Petr Menšík
Software Engineer, RHEL
Red Hat, <a class="moz-txt-link-freetext" href="https://www.redhat.com/">https://www.redhat.com/</a>
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB</pre>
</body>
</html>