# Dyndns whitelist

**URL:** <https://discourse.crowdsec.net/t/dyndns-whitelist/2382>\
**Category:** Uncategorized\
**Created:** [February 22, 2025, 3:17am UTC](https://discourse.crowdsec.net/t/dyndns-whitelist/2382 "2025-02-22T03:17:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ohv](https://avatars.discourse-cdn.com/v4/letter/o/97f17d/32.png) [@ohv](https://discourse.crowdsec.net/u/ohv)\
**Post date:** [February 22, 2025, 3:17am UTC](https://discourse.crowdsec.net/t/dyndns-whitelist/2382/1 "2025-02-22T03:17:22Z")

</div>

level=warning msg=“failed to run whitelist expr : cannot get Source from Alert (1:5)\n | evt.Overflow.Alert.Source.IP in LookupHost("string-dc-njhgrpjwrm.dynamic-m.com")\n | …^” id=little-meadow name=me/FQDN-whitlists stage=s01-parse

cat /dockerfiles/crowdsec/conf/parsers/s01-parse/whitelistfqdn.yaml

```auto
name: me/FQDN-whitlists
description: "Whitelist postoverflows from FQDN"
whitelist:
  reason: "do whitelistings by FQDN"
  expression:
    - evt.Overflow.Alert.Source.IP in LookupHost("somestring-dc-njhgrpjwrm.dynamic-m.com")
    - evt.Overflow.Alert.Source.IP in LookupHost("anotherstring-ztwtkndmrm.dynamic-m.com")

```

what am I doing wrong here?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [February 24, 2025, 9:52am UTC](https://discourse.crowdsec.net/t/dyndns-whitelist/2382/2 "2025-02-24T09:52:30Z")

</div>

> [@ohv](#):
>
> cat /dockerfiles/crowdsec/conf/parsers/s01-parse/whitelistfqdn.yaml

`evt.Overflow` is apart of the postoverflow stage as per documentation this should be within

```bash
Linux: /etc/crowdsec/postoverflows/s01-whitelist/
Postoverflow whitelist folders do not exist by default so you MUST manually create them

```

[documentation](https://docs.crowdsec.net/docs/next/log_processor/whitelist/create_postoverflow)