[FR] CNAME filtering

Current behavior
Is there a current behavior that the feature relates to?
If yes, would you wish the current behavior to change?
?

Describe the desired feature
A clear and concise description of what the feature should be.

Many sites are hiding their ads via CNAME, like:

media.evilsite.net CNAME testcdn.ad-example.com
testcdn.ad-example.com CNAME yearn.ad-example.net
yearn.ad-example.net CNAME cdn.advertise.online
cdn.advertise.online AAAA 1::1

I want Unbound to block(return 0.0.0.0/::0) when the CNAME chain contains "ad-example.net"/"*.ad-example.net"

Is this possible? Currently only dnscrypt-proxy can do this.

Potential use-case
Describe how you see this feature being useful to other Unbound users.

[wcawijngaards]

The RPZ can filter things. This is documented, https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#response-policy-zone-options . For example, have an rpz, that has a qname filter set for "ad-example.net". That should also filter after a CNAME, (this needs an unbound version that is semi-recent for that feature to be implemented). With RPZ it is possible to then choose how it is blocked (NXDOMAIN, or a particular IP address).

Alternatively, it is possible to make a forward-zone, or stub-zone for 'ad-example.net' and then unbound would send queries for that to that particular upstream. That is not really a filter feature, of course.

Sorry but both DNSMasq / DNSCrypt-proxy is MUCH easier than unbound because both have configuration file with clear example config.

Created NLnetLabs/unbound-manual#66