Drop DNS queries for specific domain names only

dropnames.sh

#!/bin/sh
# Drop DNS queries for specific domain names only
for DOMAIN in $@; do
    HEX=$(perl -e 'print map {chr(length($_)).$_} split /\./, "'$DOMAIN'"' | xxd -p)

    iptables -A OUTPUT -p udp --dport 53 \
      -m string --hex-string "|$HEX|" --algo bm -j DROP

    # Alternatively, drop responses only
    # Note that this is NOT correct and will drop any response *containing* this name,
    # not only responses for this name
    # iptables -A INPUT -p udp --sport 53 \
    #   -m string --hex-string "|$HEX|" --algo bm -j DROP
done