anchor.diff:                        1H  ; retry 
                         1W  ; expiry 
                         1H) ; minimum 
  -              IN    NS    localhost.
  +                      
  +                      IN     NS      localhost.
     
    netflix.com                 CNAME   rpz-passthru.
    *.netflix.com               CNAME   rpz-passthru.
  
positive.code:                      1H) ; minimum 
               IN    NS    localhost.
  
  * CNAME   .
  ....
  
  With the config in place I was able to reload Bind and check if it was working.  
  
negative.code: 
  I recently got a Samsung 'smart' TV which is very nice to look at.
  
  Unfortunately there have been numerous privacy issues with smart TV's of all kinds, and Samsung in http://www.bbc.com/news/technology-31296188[particular].  So to be safe I initially decided to block the TV completely from connecting to the internet, using an ACL on my router.
  
  As it turns out however, the built-in Netflix app on the TV is my only option for 4k now (HTPC was out due to not having a Kaby Lake chip).
  
  