PowerDNS Recursor¶

Introduction
- Notable features
- Getting support
- Third party software
  - Protozero
Getting Started
- Installation
- Configuring PowerDNS Recursor
- Using Ansible
Operating PowerDNS Recursor
- Logging
  - Logging to syslog
- Cache Management
- Tracing Queries
DNSSEC in the PowerDNS Recursor
- DNSSEC settings
- Trust Anchor Management
  - Trust Anchors
  - Negative Trust Anchors
PowerDNS Recursor Settings
- aggressive-nsec-cache-size
- aggressive-cache-min-nsec3-hit-ratio
- allow-from
- allow-from-file
- allow-notify-for
- allow-notify-for-file
- allow-notify-from
- allow-notify-from-file
- any-to-tcp
- allow-trust-anchor-query
- api-config-dir
- api-key
- api-readonly
- api-logfile
- auth-zones
- carbon-interval
- carbon-namespace
- carbon-ourname
- carbon-instance
- carbon-server
- chroot
- client-tcp-timeout
- config-dir
- config-name
- cpu-map
- daemon
- dont-throttle-names
- dont-throttle-netmasks
- disable-packetcache
- disable-syslog
- distribution-load-factor
- distribution-pipe-buffer-size
- distributor-threads
- dot-to-auth-names
- dot-to-port-853
- dns64-prefix
- dnssec
- dnssec-log-bogus
- dont-query
- ecs-add-for
- ecs-ipv4-bits
- ecs-ipv4-cache-bits
- ecs-ipv6-bits
- ecs-ipv6-cache-bits
- ecs-ipv4-never-cache
- ecs-ipv6-never-cache
- ecs-minimum-ttl-override
- ecs-cache-limit-ttl
- ecs-scope-zero-address
- edns-outgoing-bufsize
- edns-padding-from
- edns-padding-mode
- edns-padding-out
- edns-padding-tag
- edns-subnet-whitelist
- edns-subnet-allow-list
- entropy-source
- etc-hosts-file
- event-trace-enabled
- export-etc-hosts
- export-etc-hosts-search-suffix
- extended-resolution-errors
- forward-zones
- forward-zones-file
- forward-zones-recurse
- gettag-needs-edns-options
- hint-file
- ignore-unknown-settings
- include-dir
- latency-statistic-size
- local-address
- local-port
- log-timestamp
- non-local-bind
- loglevel
- log-common-errors
- log-rpz-changes
- logging-facility
- lowercase-outgoing
- lua-config-file
- lua-dns-script
- lua-maintenance-interval
- max-busy-dot-probes
- max-cache-bogus-ttl
- max-cache-entries
- max-cache-ttl
- max-concurrent-requests-per-tcp-connection
- max-include-depth
- max-generate-steps
- max-mthreads
- max-packetcache-entries
- max-qperq
- max-ns-address-qperq
- max-ns-per-resolve
- max-negative-ttl
- max-recursion-depth
- max-tcp-clients
- max-tcp-per-client
- max-tcp-queries-per-connection
- max-total-msec
- max-udp-queries-per-round
- minimum-ttl-override
- new-domain-tracking
- new-domain-log
- new-domain-lookup
- new-domain-db-size
- new-domain-history-dir
- new-domain-whitelist
- new-domain-ignore-list
- new-domain-pb-tag
- network-timeout
- non-resolving-ns-max-fails
- non-resolving-ns-max-throttle-time
- nothing-below-nxdomain
- nsec3-max-iterations
- packetcache-ttl
- packetcache-servfail-ttl
- pdns-distributes-queries
- protobuf-use-kernel-timestamp
- proxy-protocol-from
- proxy-protocol-maximum-size
- public-suffix-list-file
- qname-minimization
- query-local-address
- query-local-address6
- quiet
- record-cache-locked-ttl-perc
- record-cache-shards
- refresh-on-ttl-perc
- reuseport
- rng
- root-nx-trust
- save-parent-ns-set
- security-poll-suffix
- serve-rfc1918
- serve-stale-extensions
- server-down-max-fails
- server-down-throttle-time
- server-id
- setgid, setuid
- signature-inception-skew
- single-socket
- snmp-agent
- snmp-master-socket
- snmp-daemon-socket
- socket-dir
- socket-owner, socket-group, socket-mode
- spoof-nearmiss-max
- stack-cache-size
- stack-size
- statistics-interval
- stats-api-blacklist
- stats-api-disabled-list
- stats-carbon-blacklist
- stats-carbon-disabled-list
- stats-rec-control-blacklist
- stats-rec-control-disabled-list
- stats-ringbuffer-entries
- stats-snmp-blacklist
- stats-snmp-disabled-list
- structured-logging
- structured-logging-backend
- tcp-fast-open
- tcp-fast-open-connect
- tcp-out-max-idle-ms
- tcp-out-max-idle-per-auth
- tcp-out-max-queries
- tcp-out-max-idle-per-thread
- threads
- trace
- udp-source-port-min
- udp-source-port-max
- udp-source-port-avoid
- udp-truncation-threshold
- unique-response-tracking
- unique-response-log
- unique-response-db-size
- unique-response-history-dir
- unique-response-pb-tag
- use-incoming-edns-subnet
- version
- version-string
- webserver
- webserver-address
- webserver-allow-from
- webserver-hash-plaintext-credentials
- webserver-loglevel
- webserver-password
- webserver-port
- write-pid
- xpf-allow-from
- xpf-rr-code
- x-dnssec-names
Advanced Configuration Using Lua
- Managing DNSSEC Trust Anchors in the Lua Configuration
- Logging DNS messages with Protocol Buffers
- Response Policy Zones (RPZ)
- Evaluation order
- Configuring RPZ
  - Extended Errors
- RPZ Configuration Functions
- RPZ settings
- Extra settings for rpzPrimary
  - tsigname
  - tsigalgo
  - tsigsecret
  - refresh
  - maxReceivedMBytes
  - localAddress
  - axfrTimeout
  - dumpFile
  - seedFile
- Policy Actions
- Using Sortlist
  - addSortList
- Zone to Cache
- Adding Additional Records to Results
  - Configuring additional record processing
- Table Based Proxy Mapping
Scripting PowerDNS Recursor
- Configuring Lua scripts
- The DNSQuestion (dq) object
- DNSHeader Object
- DNSRecord Object
- The EDNSOptionView Class
- The ProxyProtocolValue Class
- DNS names and comparing them
  - The DNSName object
  - DNS Suffix Match Group
- DNS Record
- The ComboAddress class
- Netmasks and NetMaskGroups
  - Netmask class
  - NetMaskGroup class
- Policy Events
  - PolicyEvent class
- Lua Scripting and Statistics
  - Generating Metrics
  - Looking at Statistics
- Logging from the Lua scripts
- Intercepting queries with Lua
- Lua FFI API
  - Functions for gettag_ffi()
  - Functions for postresolve_ffi()
- Other functions
- Checking available features
DNS64 support
- Native DNS64 support
- Scripted DNS64 Support
Metrics and Statistics
- Regular Statistics Log
- Multi-threading and metrics
- Sending metrics to Graphite/Metronome over Carbon
- Getting Metrics from the Recursor
- Sending metrics over SNMP
  - MIB
- Gathered Information
Performance Guide
- Threading and distribution of queries
- MTasker and MThreads
- Performance tips
- Connection tracking and firewalls
- Tuning Incoming TCP and Out-of-Order processing
- TCP Fast Open Support
- Running with a local root zone
- Recursor Caches
- Measuring performance
- Event Tracing
Manual Pages
- pdns_recursor
  - Synopsis
  - Description
  - Examples
  - Options
  - See also
- rec_control
  - Synopsis
  - Description
  - Examples
  - Options
  - Commands
  - See also
Built-in Webserver and HTTP API
- Data format
- Server
- Zones
  - Zone
  - RRSet
  - RREntry
  - Comment
- ConfigSetting
- StatisticItem
- Webserver
- Enabling the API
- URL Endpoints
Security of the PowerDNS Recursor
- PowerDNS Security Policy
  - HackerOne
  - Disclosure Policy
- Anti-spoofing
- Throttling
- Security Polling
  - Details
Security Advisories
- PowerDNS Security Advisory 2023-01: unbounded recursion results in program termination
- PowerDNS Security Advisory 2022-02: incomplete exception handling related to protobuf message generation
- PowerDNS Security Advisory 2022-01: incomplete validation of incoming IXFR transfer in Authoritative Server and Recursor
- PowerDNS Security Advisory 2020-07: Cache pollution
- PowerDNS Security Advisory 2020-04: Access restriction bypass
- PowerDNS Security Advisory 2020-03: Information disclosure
- PowerDNS Security Advisory 2020-02: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2020-01: Denial of Service
- PowerDNS Security Advisory 2019-02: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2019-01: Lua hooks are not applied in certain configurations
- PowerDNS Security Advisory 2018-09: Crafted query can cause a denial of service
- PowerDNS Security Advisory 2018-07: Crafted query for meta-types can cause a denial of service
- PowerDNS Security Advisory 2018-06: Packet cache pollution via crafted query
- PowerDNS Security Advisory 2018-04: Crafted answer can cause a denial of service
- PowerDNS Security Advisory 2018-01: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2017-08: Crafted CNAME answer can cause a denial of service
- PowerDNS Security Advisory 2017-07: Memory leak in DNSSEC parsing
- PowerDNS Security Advisory 2017-06: Configuration file injection in the API
- PowerDNS Security Advisory 2017-05: Cross-Site Scripting in the web interface
- PowerDNS Security Advisory 2017-03: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2016-04: Insufficient validation of TSIG signatures
- PowerDNS Security Advisory 2016-02: Crafted queries can cause abnormal CPU usage
- PowerDNS Security Advisory 2015-01: Label decompression bug can cause crashes or CPU spikes
- PowerDNS Security Advisory 2014-02: PowerDNS Recursor 3.6.1 and earlier can be made to provide bad service
- PowerDNS Security Advisory 2014-01: PowerDNS Recursor 3.6.0 can be crashed remotely
- PowerDNS Security Advisory 2010-02: PowerDNS Recursor up to and including 3.1.7.1 can be spoofed into accepting bogus data
- PowerDNS Security Advisory 2010-01: PowerDNS Recursor up to and including 3.1.7.1 can be brought down and probably exploited
- PowerDNS Security Advisory 2008-01: System random generator can be predicted, leading to the potential to ‘spoof’ PowerDNS Recursor
- PowerDNS Security Advisory 2006-02: Zero second CNAME TTLs can make PowerDNS exhaust allocated stack space, and crash
- PowerDNS Security Advisory 2006-01: Malformed TCP queries can lead to a buffer overflow which might be exploitable
- Older security advisories
Upgrade Guide
- 4.8.0 to master
  - Metrics
  - rec_control
- 4.8.1 to 4.8.2
  - Cache eviction policy
- 4.7.0 to 4.8.0
- 4.7.2 to 4.7.3
  - New settings
- 4.6.2 to 4.7.0
- 4.6.3 to 4.6.4
  - New settings
- 4.6.1 to 4.6.2
  - Deprecated and changed settings
- 4.5.x to 4.6.1
- 4.5.10 to 4.5.11
  - New settings
- 4.5.1 to 4.5.2
  - Deprecated and changed settings
- 4.4.x to 4.5.1
- 4.3.x to 4.4.0
- 4.2.x to 4.3.0
- 4.1.x to 4.2.0
- 4.0.x to 4.1.0
- 4.0.3 to 4.0.4
- 4.0.0 to 4.0.1
Changelogs
- Changelogs for 4.8.X
  - 4.8.3
  - 4.8.2
  - 4.8.1
  - 4.8.0
  - 4.8.0-rc1
  - 4.8.0-beta2
  - 4.8.0-beta1
  - 4.8.0-alpha1
- Changelogs for 4.7.X
  - 4.7.4
  - 4.7.3
  - 4.7.2
  - 4.7.1
  - 4.7.0
  - 4.7.0-rc1
  - 4.7.0-beta1
  - 4.7.0-alpha1
- Changelogs for 4.6.X
  - 4.6.5
  - 4.6.4
  - 4.6.3
  - 4.6.2
  - 4.6.1
  - 4.6.0
  - 4.6.0-rc1
  - 4.6.0-beta2
  - 4.6.0-beta1
  - 4.6.0-alpha2
  - 4.6.0-alpha1
- Changelogs for 4.5.X
  - 4.5.12
  - 4.5.11
  - 4.5.10
  - 4.5.9
  - 4.5.8
  - 4.5.7
  - 4.5.6
  - 4.5.5
  - 4.5.4
  - 4.5.2
  - 4.5.1
  - 4.5.0
  - 4.5.0-rc1
  - 4.5.0-beta2
  - 4.5.0-beta1
  - 4.5.0-alpha3
  - 4.5.0-alpha2
  - 4.5.0-alpha1
- Changelogs for 4.4.x
  - 4.4.8
  - 4.4.7
  - 4.4.6
  - 4.4.5
  - 4.4.4
  - 4.4.3
  - 4.4.2
  - 4.4.1
  - 4.4.0
  - 4.4.0-rc2
  - 4.4.0-rc1
  - 4.4.0-beta1
  - 4.4.0-alpha2
  - 4.4.0-alpha1
- Changelogs for 4.3.x
  - 4.3.7
  - 4.3.6
  - 4.3.5
  - 4.3.4
  - 4.3.3
  - 4.3.2
  - 4.3.1
  - 4.3.0
  - 4.3.0-rc2
  - 4.3.0-rc1
  - 4.3.0-beta2
  - 4.3.0-beta1
  - 4.3.0-alpha3
  - 4.3.0-alpha2
  - 4.3.0-alpha1
- Changelogs for 4.2.x
  - 4.2.5
  - 4.2.4
  - 4.2.3
  - 4.2.2
  - 4.2.1
  - 4.2.0
  - 4.2.0-rc2
  - 4.2.0-rc1
  - 4.2.0-beta1
  - 4.2.0-alpha1
- Changelogs for 4.1.x
  - 4.1.18
  - 4.1.17
  - 4.1.16
  - 4.1.15
  - 4.1.14
  - 4.1.13
  - 4.1.12
  - 4.1.11
  - 4.1.10
  - 4.1.9
  - 4.1.8
  - 4.1.7
  - 4.1.6
  - 4.1.5
  - 4.1.4
  - 4.1.3
  - 4.1.2
  - 4.1.1
  - 4.1.0
  - 4.1.0-rc3
  - 4.1.0-rc2
  - 4.1.0-rc1
  - 4.1.0-alpha1
- Changelogs for 4.0.x
- Changelogs for all pre 4.0 releases
Newly Observed Domain Tracking
- Logging
- DNS Lookup
- Protobuf Logging
Unique Domain Response
- Logging
- Protobuf Logging
End of life statements
Frequently Asked Questions
- EDNS bufsize in response packets
- Handling of root hints
Compiling PowerDNS Recursor
- Getting the sources
- Dependencies
- Compiling from a git checkout
- macOS Notes
  - Lua scripting
- Optional dependencies
- Documentation
Cryptographic software and export control
- Specific United States Export Control Notes
Internals of the PowerDNS Recursor
- The PowerDNS Recursor
- Synchronous code using MTasker
- MPlexer
- MOADNSParser
- The C++ Standard Library / Boost
- Actual DNS Algorithm
  - The non-cached case
- QName Minimization
- Some of the things we glossed over
- The Recursor Cache
- Serve Stale
- Some small things
PowerDNS/dnsdist license