Warda-DNSDocs Warda: from ward — to protect, guardian
v0.8.2
Menu

Reputation of the domains

From 0.8.2 (free, beta, feature reputation; internal/reputation, internal/admin/reputation.go). A site of phishing opened the same day is on no list yet; the analysis service of Warda (warda-analyst, through the online service warda-cloud) may already know it. Protection → Protections, card Reputation of the domains (the roles that change the rules; on by default) asks it about the domains the household does not know well, as they are asked.

  • Which domains are asked about: a domain on no list, no rule (of the network or of the device), no category, not among the 500 names the household asked most over 30 days (those of the look-alike names) nor a known service. A domain the look-alike check finds suspicious itself (a homograph or a typing mistake; not a known name with a word added) is asked at once, even when it is familiar. A rule that allows the name (personal, of the device, an unblock request approved) always wins: the name is never asked about. The local names (.lan, .home, the reverse lookups…) never are.
  • What leaves the box: the registrable domain alone (example.com for a.b.example.com), in a request signed by the key of the box (POST /v1/domains/reputation {"domain": "example.com"}, see cloud); never the full name, the device, the person nor the time. warda-cloud asks the analysis service with the domain only (the analysis service cannot tell which box asked), keeps the answers by domain in memory only (6 hours at most), shared by every box, and logs no domain.
  • Never waited for long: the first query of a domain the look-alike check finds suspicious waits 1.5 seconds at most for the answer (the queries of the same name asked meanwhile, A and AAAA, wait for the same question); every other first query is answered at once, and the answer serves the next queries (a page asks its names again and again). Without an answer (no service, a time out, an error, the questions spent), the name is answered as without the reputation: the lists, the categories and the other protections still apply. A domain whose question failed is not asked again for 10 minutes; a 429 or a 503 of the service pauses every question for its Retry-After (5 minutes to 24 hours), a service that does not know the question yet (404, older than 0.8.2) for 6 hours.
  • The decisions (the verdict of the analysis service, its category and its reasons, and the date the domain was registered when the registry tells it):
    • malicious: blocked for every device, like the security category (before the pauses; reason reputation);
    • suspicious: blocked for the minors — a child, a teenager, a device shared with one, a device placed nowhere when unknown devices are protected as a minor — while Block the suspicious domains for the children and teenagers is on (the default), told otherwise;
    • suspicious and registered less than 14 days ago: blocked for everyone while Block for everyone the suspicious domains registered less than 14 days ago is on;
    • clean, unknown, or still analysed (pending): nothing.
  • Kept on the box, in memory: each answer for the time the service gives (1 minute to 24 hours; 2 minutes while the analysis runs), 8,192 domains at most. Questions: 45 an hour (60 for the domains the look-alike check finds suspicious, never starved by the others), 800 a day, so that a page that makes up hundreds of names cannot spend the questions of the household.
  • Nothing is asked before an administrator accepts the terms of use in force (2026-10-13, which list the questions; TermsCurrent, read again every 30 seconds at most and at once on acceptance): the card then says "The questions wait for an administrator to accept the terms of use in force, which list them: until then, nothing leaves the box; the other protections apply as before." The card also says when the online service is not set on the box ("no question is asked").
  • Seen: the query log gives the origin reputation:<kind>:<category> (kind malicious, young or suspicious), shown "Analysis of Warda: malicious (phishing)", for a name blocked and for one told; each domain decided is a notice reputation (see Alerts; detail domain|kind|blocked or told|category|reasons, the first two reasons of the analysis service, in English whatever the language), once a day by device, domain and kind, with the device and never its person, as for the look-alike names; Reports gives the block reason Reputation of the domains; the card lists the Domains found over 30 days (100 at most) and the questions since the start.
  • "Something is broken" does not open a domain the reputation blocks for that device (malicious; suspicious and new while that option is on; suspicious for a minor's device): its one-click unblock answers 409, and only a rule of the administrators opens it, as for the categories.
  • Protection outside the home: the relayed queries go through the same filter, so the same protection.

Blocking the domains younger than 14 days by default: what was decided. The category New domains (a list of the domains registered in the last 14 days) stays off by default: such a list holds tens of thousands of legitimate new domains (shops, campaigns, content networks), and blocking it would break sites without explanation. A domain is blocked for everyone only when it is new and judged suspicious by the analysis service, which needs another harmful fact besides its age (the age alone never makes a domain suspicious). That option is on for the new installations only: a migration writes it off on a box that already has an account, so an upgrade to 0.8.2 changes nothing until an administrator turns it on.

Limits. The very first visit of a domain never seen, which the look-alike check does not find suspicious, is not blocked: it does not wait, and the analysis service usually answers "pending" for a domain it never saw; the protection starts with the following queries (asked again 2 minutes later). The reasons are the English sentences of the analysis service. During a question warda-cloud sees the key and the address of the box with the domain, without keeping them together.

Settings, in the meta table: reputation (off turns every question off), reputation_minors and reputation_young (off: told, not blocked). They are in the backups and are given to the secondary of a pair, with the settings of the protections of 0.8.0 (the rule settings_complete applies: in a dump of 0.8.2, a setting missing means its default). The answers the box keeps are a cache: never in a backup.

GET /api/v1/reputation (rules read) gives enabled, minors, young, young_days (14), available (the online service is set), allowed (the terms in force accepted), stats (asked, failed, last_error, kept) and found (30 days, 100 at most: each notice with domain, why, blocked, category, reasons, the device and the time); PUT /api/v1/reputation takes enabled, minors and/or young (rules written; audit reputation.on/off, reputation.minors.on/off, reputation.young.on/off).