Irule for reverse DNS lookup

Hi,

Not sure if I understand correctly - do you need to resolve IP to FQDN instead of FQDN to IP?

If so you need to check DNS query type like [DNS::question type] equals "PTR" and then execute necessary code - I guess you will need check then DNS_RESPONSE event to check if response from DNS server contains domain ending with given domain.

Something like that:

when DNS_RESPONSE {
    if { [DNS::question type] eq "PTR" } {       
        set rrs [DNS::answer]
        foreach rr $rrs {
            if { [DNS::rdata $rr] ends_with "your.domain" } {
                log local0. "----[DNS::rdata $rr] Dropped-----"
                drop seems not be working for response
                drop
                DNS::answer clear
                DNS::answer insert "@ 5 [DNS::question class] TXT Blocked"
                return
            }
        }
    }
}

Piotr