Chapter 12. PowerDNS resolver/recursing nameserver

As of 2.9.4, a small recursor comes with PowerDNS. The algorithm is influenced by the works of Dan J. Bernstein although all mistakes are ours. Here are the current faults, so nobody can accuse us of false advertising:

To compile, add --enable-recursor to configure and the file pdns_recursor will be compiled. To run on a different port, use ./syncres --local-port=53. To bind to another address, use the local-address setting.

Good points:

12.1. pdns_recursor settings

At startup, the recursing nameserver reads the file recursor.conf from the configuration directory, often /etc/powerdns or /usr/local/etc.

The following settings can be configured:

aaaa-additional-processing

If turned on, the recursor will attempt to add AAAA IPv6 records to questions for MX records and NS records. Can be quite slow as absence of these records in earlier answers does not guarantee their non-existance. Can double the amount of queries needed. Off by default.

client-tcp-timeout

Time to wait for data from TCP clients. Defaults to 2 seconds. Available since 2.9.18.

config-dir

Directory where the configuration file can be found.

daemon

Operate in the background, which is the default.

delegation-only

A Verisign special, see Section 12.1.1.

hints-file

If set, the root-hints are read form this file. If unset, default root hints are used. Available since 2.9.19.

local-address

Local IP address (singular) to bind to. Defaults to all addresses.

local-port

Local port (singular) to bind to. Defaults to 53.

max-tcp-clients

Maximum number of simultaneous incoming TCP connections allowed. Defaults to 128. Available since 2.9.18.

query-local-address

Send out local queries from this address. Useful for anycast.

quiet

Don't log queries.

trace

If turned on, output impressive heaps of logging. May destroy performance under load.

12.1.1. Verisign weirdness

Verisign, the current operator of the COM and NET zones, decided to add a wildcard record so as to draw all queries for non-existing domains to their own page, which lists domains you might want to visist instead.

To reinstate old behaviour, add delegation-only=com,net to your recursor configuration.

What this does is reject all authoritative answers from the COM and NET servers. ISC, the current maintainers of BIND, have implemented this feature first, PowerDNS has mostly copied their algorithm. Thanks!

Verisign might decide to evade our tactic with wildcard NS records, by which time other measures will be needed to restore the old behaviour.