anchor.diff:                       1H  ; retry 
                        1W  ; expiry 
                        1H) ; minimum 
  +                     
                IN    NS    localhost.
   
   *                  CNAME .
  
positive.code: 
  In addition to the above I changed the ACL for traffic coming from the TV to only allow TCP on ports 80 and 443.  This is enough for Netflix, but importantly blocks the TV from using any external DNS (even in normal circumstances it looks like the TV uses 8.8.8.8 in addition to any DNS server you give it yourself.)
  
  Finally on the TV I changed the DNS server and sure enough the TV thinks something is wrong with DNS:
  
  image::https://cloud.githubusercontent.com/assets/4465905/26027929/bd59e8b2-380e-11e7-81b1-b8b2b8fd2ffe.JPG[Samsung Error Message]
  
  
negative.code: 
  The first step is to get a basic Bind resolver up and running.  I did this with a Ubuntu 16.04 system.
  
  I then configured a 'response-policy' block in the 'options' section of named.conf (on my particular system I did it in /etc/bind/named.conf.options).  This lists two RPZ zones which are used to define what queries to filter.  The key thing here is that RPZ checks these zones in the order they are listed - this is key to creating a whitelist as opposed to a blacklist.  A single line is required:
  
   response-policy { zone "rpz.whitelist"; zone "rpz"; };
   
  All queries will then be filtered based on the response policy zones listed.  If a match is found in the first (rpz.whitelist) then that will be used, otherwise the second one (rpz) will be checked.
  
  The Bind server needs to be configured as authorititive master for these zones, similar to a standard zone.  Again this is in named.conf (in my case /etc/bind/named.conf.default-zones):
  
   zone "rpz.whitelist" {
      type master;
      file "/etc/bind/db.rpz.whitelist";
      allow-query { none; };
      allow-transfer {"none";};
   };
   
   zone "rpz" {
      type master;
      file "/etc/bind/db.rpz";
      allow-query { none; };
      allow-transfer {"none";};
   };
  
  As can be seen the zone definitions reference the location of the zone files for each.  The files are created as shown below, using the RPZ syntax.  The first zone, rpz.whitelist, is where to define the domains we want to allow.  In my case it looks like this:
  