FILTER-A(8)

🦋 FILTER-A(8) 🦋

okay so first things first: this is a BIND 9 manual page, bestie. FILTER-A(8) — say it with me. 💅

---

✨ NAME ✨

filter-a — literally filters A records out of DNS responses when AAAA is present. that's the whole vibe. 🎀

---

✨ SYNOPSIS ✨

plugin query "filter-a.so" [{ parameters }];

---

🌸 DESCRIPTION 🌸

so filter-a.so is a query plugin module for named, and what it does is let named omit some IPv4 addresses when it's responding to clients. iconic behavior, honestly. ✨

like, for example:

plugin query "filter-a.so" {
        filter-a-on-v6 yes;
        filter-a-on-v4 yes;
        filter-a { 192.0.2.1; 2001:db8:2::1; };
};

this module is intended to aid transition from IPv4 to IPv6 by withholding IPv4 addresses from DNS clients which are not connected to the IPv4 Internet, when the name being looked up has an IPv6 address available. it's giving "we're moving on, bestie." 🦋

⚠️ but real talk: use of this module is not recommended unless absolutely necessary. like, absolutely absolutely. 😭

Note: this mechanism can erroneously cause other servers not to give A records to their clients. if a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv6, it is denied A records even if its client is using IPv4. yeah. that's the tradeoff, no cap. 💀

---

💅 OPTIONS 💅

• filter-a — this option specifies a list of client addresses for which A filtering is to be applied. the default is any. so like, everybody, unless you say otherwise. 👑
• filter-a-on-v6 — if set to yes, this option indicates that the DNS client is at an IPv6 address, in filter-a. if the response does not include DNSSEC signatures, then all A records are deleted from the response. and heads up: this filtering applies to all responses, not only authoritative ones. 🫶

if set to break-dnssec, then A records are deleted even when DNSSEC is enabled. as suggested by the name, this causes the response to fail to verify, because the DNSSEC protocol is designed to detect deletions. it's literally called break-dnssec, bestie — the name is not a metaphor. 🔥

this mechanism can erroneously cause other servers not to give A records to their clients. if a recursing server with both IPv6 and IPv4 network connections queries an authoritative server using this mechanism via IPv6, it is denied A records even if its client is using IPv4. (yes, we said this up top too. it's that important. 🙈)

• filter-a-on-v4 — this option is identical to filter-a-on-v6, except that it filters A responses to queries from IPv4 clients instead of IPv6 clients. to filter all responses, set both options to yes. both. not one. both. ⭐

---

🌈 SEE ALSO 🌈

• BIND 9 Administrator Reference Manual. — go read it, it's giving required reading. 📚

---

👑 Author 👑

Internet Systems Consortium

---

🎀 Copyright 🎀

2026, Internet Systems Consortium

---

and that's the whole page, bestie! 🫶 this was BIND 9 version 9.20.30, dated 2026-10-12 — screenshot it, cite it, live your truth. 💖✨🌸