sanity check: localhost rpz

[Lee]

With a few exceptions, I'd like to block external answers for 127.0.0.0/8

Is the following really how it's supposed to be done? I can see
having to whitelist the net-snmp.org names, but having to whitelist
zones I'm authoritative for seems a bit weird.

named.conf:
options {
...
response-policy { zone "rpz.zone" log yes; } break-dnssec yes
recursive-only no;
};
zone "localhost" in { type master; allow-update{none;}; file
"ZONES/master.localhost"; };
zone "home.net" in { type master; allow-update{none;}; file "ZONES/home.net"; };


rpz.zone:
...
; return NXDOMAIN for any 127.0.0.0/8 answers
; exceptions:
onea.net-snmp.org CNAME rpz-passthru.
twoa.net-snmp.org CNAME rpz-passthru.
localhost CNAME rpz-passthru.
localhost.home.net CNAME rpz-passthru.
8.0.0.0.127.rpz-ip CNAME .
; check:
; localhost 127.0.0.1
; onea.net-snmp.org 127.0.0.1
; twoa.net-snmp.org 127.0.0.2 127.0.0.3
; 7f000001.c7f11de3.rbndr.us
; should alternate between 199.241.29.227 (allowed) and
127.0.0.1 (NXDOMAIN)
; ref: https://bugs.chromium.org/p/project-zero/issues/detail?id=1471&desc=3


Thanks
Lee