&gt; Are you talking about the ability to NXDOMAIN [star].example.com while also whitelisting this.example.com?<p>Yeah, you can totally do that! Details are here [0][1], but in your RPZ zone file, you use a CNAME with a value of . to return NXDOMAIN, and a CNAME with a value of rpz-passthru. to process the query normally:<p><pre><code>  ;allow www.sinfest.net, but deny all others, including sinfest.net
  www.sinfest.net CNAME   rpz-passthru.
  sinfest.net CNAME       .
  *.sinfest.net CNAME     .
</code></pre>
And to demonstrate:<p><pre><code>  $ dig +short www.sinfest.net ; dig +short sinfest.net; \
  dig +short www.sinfest.net @8.8.8.8 ; dig +short sinfest.net @8.8.8.8
  64.29.145.9
  64.29.145.9
  64.29.145.9
  $
</code></pre>
If you&#x27;re interested in a complete, but simple RPZ zone file I can provide one. If you have more questions, feel free to ask, and I&#x27;ll try to answer.<p>[0] <a href="http:&#x2F;&#x2F;www.zytrax.com&#x2F;books&#x2F;dns&#x2F;ch7&#x2F;rpz.html" rel="nofollow">http:&#x2F;&#x2F;www.zytrax.com&#x2F;books&#x2F;dns&#x2F;ch7&#x2F;rpz.html</a><p>[1] <a href="http:&#x2F;&#x2F;www.zytrax.com&#x2F;books&#x2F;dns&#x2F;ch7&#x2F;rpz.html#rpz-examples" rel="nofollow">http:&#x2F;&#x2F;www.zytrax.com&#x2F;books&#x2F;dns&#x2F;ch7&#x2F;rpz.html#rpz-examples</a>