Are you talking about the ability to NXDOMAIN *.example.com while also whitelisting this.example.com? AFAICT dnsmasq cant do this, I&#x27;m interested if bind can. I have a simple DNS request forwarder half-written to deal with rule trees.<p>Edit: <a href="https:&#x2F;&#x2F;github.com&#x2F;paulchakravarti&#x2F;dnslib" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;paulchakravarti&#x2F;dnslib</a> looks interesting