DNS block page configuration
Overview When DNS policy blocks a domain, Axiom can return a controlled IPv4 address and serve a branded explanation page from the DNS node. The Managemen
DNS block page configuration
Overview
When DNS policy blocks a domain, Axiom can return a controlled IPv4 address and serve a branded explanation page from the DNS node. The Management policy editor supports a custom logo, UTF-8 text including Hebrew, accent color, support text and a support link.
The page and logo are embedded in policy, so rendering does not require internet access.
Block Response choices
| Choice | Result | User experience |
|---|---|---|
| NXDOMAIN | Domain does not exist | Browser displays a DNS error |
| REFUSED | Resolver refuses the query | Browser displays a resolution failure |
| Branded block page | A record points to block-page IPv4 | HTTP browser displays the policy page |
HTTP and HTTPS are different
For HTTP, the browser resolves the domain, connects to TCP 80 and sends the original domain in the Host header. Axiom can display the page normally.
For HTTPS, certificate validation happens before the browser sends an HTTP request. Axiom does not impersonate arbitrary domains and cannot provide a certificate valid for every blocked site. The browser normally shows a certificate warning before a custom page can appear. A clean HTTPS block page requires a separate organization-approved TLS inspection platform and trusted enterprise CA.
Editor fields
| Field | Meaning |
|---|---|
| Serve block page | Enables the local TCP 80 listener when branded mode is active |
| Block Page IPv4 | Blank uses each DNS node's listener IP; explicit IPv4 targets an external page/VIP |
| Organization Name | Brand or security-team name |
| Accent Color | Valid #RRGGBB page color |
| Title and Message | UTF-8 content; Hebrew and line breaks are supported |
| Support Text | Help-desk instruction |
| Support URL | Optional https://, http://, or mailto: link |
| Custom Logo | Embedded PNG, JPEG or WebP up to 256 KB |
Use Axiom logo removes a custom image. Reset Axiom defaults restores the built-in copy and colors in the editor. Click Save and apply to persist and push changes.
Cluster behavior
Blank Block Page IPv4 stores automatic mode (0.0.0.0). Every DNS replica returns its own local listener IPv4 and serves the same centrally managed page on TCP 80. Client networks must route to every DNS node.
To use an external block-page service or VIP, enter its explicit IPv4. Nodes return that address and do not bind their local TCP 80 listener for the external policy.
Security and availability
The local server allows only GET and HEAD, limits headers to 16 KB, uses a five-second read timeout, limits concurrent connections, HTML-escapes policy and host data, disables caching and framing, and applies a restrictive Content Security Policy. It loads no external scripts, fonts or images.
If TCP 80 cannot bind, DNS resolution remains available. The node logs the error and retries every 15 seconds.
Network requirement
Client networks -> every automatic DNS block-page node TCP 80: allow
For an external sinkhole address, allow TCP 80 to that service instead. No inbound internet access is required.
Validation
- Open DNS Security.
- Set Blocked Domain Action to
block. - Select Branded block page.
- Leave Block Page IPv4 blank for automatic mode.
- Add a controlled blocked test domain.
- Customize content and select Save and apply.
- Confirm every DNS node acknowledges the push.
- Query the test domain against each DNS node and verify its A record.
- Open the HTTP URL and verify logo, text direction, color and support link.
- Test the HTTPS URL and document the expected certificate warning.
Troubleshooting
On the DNS node:
sudo ss -lntup | egrep ':53|:80|:9443'
sudo journalctl -u axiom -n 200 -l --no-pager | egrep -i 'block page|DNS|policy'
sudo grep -nA20 '\[dns.policy.block_page\]' /etc/axiom/axiom.toml
From a client:
nslookup blocked-test.example DNS_NODE_IP
curl -v -H 'Host: blocked-test.example' http://DNS_NODE_IP/
If DNS returns the expected node address but curl fails, check TCP 80 firewall rules, network ACLs, routing and whether another service owns the port.