policy has policy.todnames() for table of names

this is Unbound's 'forward-zone' on steroids

config:
trust_anchors.negative = { ‘bad.cz’, ‘here.com’ }

all names below these NTA will not be validated
(unless there is an island of trust below these anchors)

the module can enforce RPZ from zone file, later a LMDB binary database
is going to come to solve following:
- updating zones on the fly
- instant startup (although it loads 1M blocklist in a fraction of
second)
- no extra memory usage between multiple processes
the compatibility notes are in the documentation

module can identify clients based on their source address or used TSIG
key

by default it blocks queries to private zones, can be extended to match anything in the query content (i.e. water torture style attacks)