As of 2.9.4, a small recursor comes with PowerDNS. The algorithm is influenced by the works of Dan J. Bernstein although all mistakes are ours. Here are the current faults, so nobody can accuse us of false advertising:
Only compiles on Linux, FreeBSD 5.x, Windows and possibly Solaris. FreeBSD 4.x decided not to support the POSIX get/set/swapcontext functions. Bug your favorite FreeBSD kernel or libc maintainer for a fix, or ask him to port MTasker (see below) to your operating system. It may work on recent 4.x systems, let us know!
May have big problems with truncated packets (solved in 2.9.18)
To compile, add --enable-recursor to configure and the file pdns_recursor will be compiled. To run on a different port, use ./syncres --local-port=53. To bind to another address, use the local-address setting.
Good points:
Uses MTasker (homepage)
Can handle thousands of concurrent questions
Appears to be very fast, and contains innovative query-throttling code to save time talking to obsolete or broken nameservers.
Code is written linearly, sequentially, which means that there are no problems with 'query restart' or anything.
Relies heavily on Standard C++ Library infrastructure, which makes for little code (406 core lines).
Is very verbose in showing how recursion actually works.
The algorithm is simple and quite nifty.
At startup, the recursing nameserver reads the file recursor.conf from the configuration directory, often /etc/powerdns or /usr/local/etc.
The following settings can be configured:
If turned on, the recursor will attempt to add AAAA IPv6 records to questions for MX records and NS records. Can be quite slow as absence of these records in earlier answers does not guarantee their non-existance. Can double the amount of queries needed. Off by default.
Time to wait for data from TCP clients. Defaults to 2 seconds. Available since 2.9.18.
Directory where the configuration file can be found.
Operate in the background, which is the default.
A Verisign special, see Section 12.1.1.
Local IP address (singular) to bind to. Defaults to all addresses.
Local port (singular) to bind to. Defaults to 53.
Maximum number of simultaneous incoming TCP connections allowed. Defaults to 128. Available since 2.9.18.
Send out local queries from this address. Useful for anycast.
Don't log queries.
If turned on, output impressive heaps of logging. May destroy performance under load.
Verisign, the current operator of the COM and NET zones, decided to add a wildcard record so as to draw all queries for non-existing domains to their own page, which lists domains you might want to visist instead.
To reinstate old behaviour, add delegation-only=com,net to your recursor configuration.
What this does is reject all authoritative answers from the COM and NET servers. ISC, the current maintainers of BIND, have implemented this feature first, PowerDNS has mostly copied their algorithm. Thanks!
Verisign might decide to evade our tactic with wildcard NS records, by which time other measures will be needed to restore the old behaviour.