PowerDNS Authoritative Server¶

PowerDNS Authoritative Nameserver
- Getting Started
- Getting Support
Installing PowerDNS
- Binary Packages
- After installation
Upgrade Notes
- 4.1.0 to 4.1.1
- 4.0.X to 4.1.0
  - Changed options
  - Other changes
- 4.0.X to 4.0.2
  - Changed options
- 3.4.X to 4.0.0
DNS Modes of Operation
- Native replication
- Master operation
- Slave operation
- Master/Slave Setup Requirements
- IXFR: incremental zone transfers
- Supermaster: automatic provisioning of slaves
- Modifying a slave zone using a script
Migrating to PowerDNS
- Using AXFR to a Slave-Capable Backend
  - To A Generic SQL Backend
  - To the BIND backend
- From zonefiles to PowerDNS
  - Using the BIND backend
  - To a Generic SQL backend
- Migrating Data from one Backend to Another Backend
  - Prerequisites
  - Moving from source to target
Running and Operating
- Guardian
- Logging to syslog on systemd-based operating systems
- Logging to syslog
- Controlling A Running PowerDNS Server
  - Control Socket
  - pdns_control
- The SysV init script
- Running in the foreground
Security of PowerDNS
- PowerDNS Security Policy
  - HackerOne
  - Disclosure Policy
- Securing the Process
  - Running as a less privileged identity
  - Jailing the process in a chroot
- Security Considerations
- Security Polling
  - Details
Performance and Tuning
- Performance related settings
- Packet Cache
- Query Cache
- Performance Monitoring
DNSSEC
- A brief introduction to DNSSEC
- DNSSEC Profile and Support
  - Supported Algorithms
- DNSSEC Modes of Operation
- pdnsutil and DNSSEC
  - DNSSEC Defaults
- Migrating (Signed) Zones to PowerDNS
- Operational instructions
- DNSSEC advice & precautions
  - Packet sizes, fragments, TCP/IP service
- PKCS#11 support
  - Using with SoftHSM
  - Using CryptAS
- Thanks to, acknowledgements
Per zone settings: Domain Metadata
- ALLOW-AXFR-FROM
- API-RECTIFY
- AXFR-SOURCE
- ALLOW-DNSUPDATE-FROM, TSIG-ALLOW-DNSUPDATE, FORWARD-DNSUPDATE, SOA-EDIT-DNSUPDATE, NOTIFY-DNSUPDATE
- ALSO-NOTIFY
- AXFR-MASTER-TSIG
- GSS-ALLOW-AXFR-PRINCIPAL
- GSS-ACCEPTOR-PRINCIPAL
- IXFR
- LUA-AXFR-SCRIPT
- NSEC3NARROW
- NSEC3PARAM
- PRESIGNED
- PUBLISH-CDNSKEY, PUBLISH-CDS
- SOA-EDIT
- SOA-EDIT-API
- TSIG-ALLOW-AXFR
- TSIG-ALLOW-DNSUPDATE
- Extra metadata
Dynamic DNS Update (RFC2136)
- Configuration options
- Per zone settings
- SOA Serial Updates
  - SOA-EDIT-DNSUPDATE settings
- DNS update How-to: Setup dyndns/rfc2136 with dhcpd
  - Setting up dhcpd
  - Setting up PowerDNS
- How it works
- Update policy
TSIG
- Provisioning outbound AXFR access
- Provisioning signed notification and AXFR requests
- GSS-TSIG support
  - Prerequisites
  - Setting up
Guides and How Tos
- Basic setup: configuring database connectivity
- Migrating from using recursion on the Authoritative Server to using a Recursor
  - Scenario 1: Authoritative Server as Recursor with private zones
  - Scenario 2: Authoritative Server as Recursor for clients and serving public domains
- Running Virtual Instances
  - Starting virtual instances with Sysv init-scripts
  - Starting virtual instances with systemd
- Using ALIAS records
  - ALIAS and DNSSEC
- KSK Rollover
- KSK Rollover using CDS & CDNSKEY Key Rollover
- ZSK Rollover
- Adding new DNS record types
Backends
- Bind zone file backend
- Generic SQL Backends
- Generic MySQL backend
- Generic ODBC Backend
- Generic Oracle backend
  - Settings
  - Caveats
- Generic PostgreSQL backend
  - Settings
  - Default schema
- Generic SQLite 3 backend
- GeoIP backend
- LDAP backend
- Lua Backend
- MyDNS Backend
  - Configuration Parameters
  - Migrating from MyDNS to another SQL backend
- OpenDBX Backend
- Oracle backend
  - Configuration Parameters
  - The Database Schema
- Pipe Backend
- Random Backend
  - Configuration Parameters
- Remote Backend
  - Important notices
  - Compiling
  - Usage
  - API
  - Examples
- TinyDNS Backend
Built-in Webserver and HTTP API
- Webserver
- Enabling the API
- Working with the API
- Endpoints and Objects in the API
  - Servers
  - Zones
  - Cryptokeys
  - Metadata
  - Searching
  - Statistics
Manual Pages
- calidns
  - Synopsis
  - Description
  - QUERY_FILE format
  - Options
- dnsbulktest
  - Synopsis
  - Description
  - Options
- dnsgram
  - Synopsis
  - Description
  - Options
  - See also
- dnspcap2protobuf
  - Synopsis
  - Description
  - Options
- dnsreplay
  - Synopsis
  - Description
  - Options
  - Bugs
  - See also
- dnsscan
  - Synopsis
  - Description
  - Options
  - See also
- dnsscope
  - Synopsis
  - Description
  - Options
  - See also
- dnstcpbench
  - Synopsis
  - Description
  - Options
  - Bugs
- dnswasher
  - Synopsis
  - Description
  - Options
  - See also
- dumresp
  - Synopsis
  - Description
  - Options
  - See also
- ixfrdist
  - Synopsis
  - Description
  - Options
  - See also
- ixplore
  - Synopsis
  - Description
  - Options
  - diff-mode
  - track-mode
  - See also
- nproxy
  - Synopsis
  - Description
  - Options
- nsec3dig
  - Synopsis
  - Description
  - Example
- pdns_control
  - Synopsis
  - Description
  - Options
  - Commands
  - See also
- pdns_notify
  - Synopsis
  - Description
  - Options
- pdns_server
  - Synopsis
  - Description
  - Options
  - See also
- pdnsutil
  - Synopsis
  - Description
  - Options
  - COMMANDS
  - DNSSEC RELATED COMMANDS
  - TSIG RELATED COMMANDS
  - ZONE MANIPULATION COMMANDS
  - DEBUGGING TOOLS
  - See also
- saxfr
  - Synopsis
  - Description
  - Options
- sdig
  - Synopsis
  - Description
  - Options
- zone2json
  - Synopsis
  - Description
  - Options
  - INPUT Options
  - OTHER Options
  - See also
- zone2ldap
  - Synopsis
  - Description
  - Options
  - See also
- zone2sql
  - Synopsis
  - Description
  - Options
  - INPUT Options
  - BACKENDS
  - OUTPUT Options
  - OTHER Options
  - JSON COMMENTS
  - See also
Authoritative Server Settings
- 8bit-dns
- allow-axfr-ips
- allow-dnsupdate-from
- allow-notify-from
- allow-unsigned-notify
- allow-unsigned-supermaster
- allow-recursion
- also-notify
- any-to-tcp
- api
- api-key
- api-readonly
- axfr-lower-serial
- cache-ttl
- carbon-ourname
- carbon-server
- carbon-interval
- chroot
- config-dir
- config-name
- control-console
- daemon
- default-ksk-algorithm
- default-ksk-size
- default-soa-name
- default-soa-edit
- default-soa-edit-signed
- default-soa-mail
- default-ttl
- default-zsk-algorithm
- default-zsk-size
- direct-dnskey
- disable-axfr
- disable-axfr-rectify
- disable-syslog
- disable-tcp
- distributor-threads
- dname-processing
- dnssec-key-cache-ttl
- dnsupdate
- do-ipv6-additional-processing
- domain-metadata-cache-ttl
- edns-subnet-processing
- entropy-source
- expand-alias
- forward-dnsupdate
- forward-notify
- guardian
- include-dir
- launch
- load-modules
- local-address
- log-timestamp
- non-local-bind
- lua-axfr-script
- local-address-nonexist-fail
- local-ipv6
- local-ipv6-nonexist-fail
- local-port
- log-dns-details
- logging-facility
- loglevel
- log-dns-queries
- lua-prequery-script
- master
- max-cache-entries
- max-ent-entries
- max-nsec3-iterations
- max-packet-cache-entries
- max-queue-length
- max-signature-cache-entries
- max-tcp-connection-duration
- max-tcp-connections
- max-tcp-connections-per-client
- max-tcp-transactions-per-conn
- module-dir
- negquery-cache-ttl
- no-config
- no-shuffle
- overload-queue-length
- reuseport
- security-poll-suffix
- server-id
- only-notify
- out-of-zone-additional-processing
- outgoing-axfr-expand-alias
- prevent-self-notification
- query-cache-ttl
- query-local-address
- query-local-address6
- query-logging
- queue-limit
- receiver-threads
- recursive-cache-ttl
- recursor
- resolver
- retrieval-threads
- setgid
- setuid
- slave
- slave-cycle-interval
- slave-renotify
- signing-threads
- soa-expire-default
- soa-minimum-ttl
- soa-refresh-default
- soa-retry-default
- socket-dir
- tcp-control-address
- tcp-control-port
- tcp-control-range
- tcp-control-secret
- tcp-fast-open
- tcp-idle-timeout
- traceback-handler
- trusted-notification-proxy
- udp-truncation-threshold
- version-string
- webserver
- webserver-address
- webserver-allow-from
- webserver-password
- webserver-port
- webserver-print-arguments
- write-pid
- xfr-max-received-mbytes
Security Advisories
- PowerDNS Security Advisory 2017-04: Missing check on API operations
- PowerDNS Security Advisory 2016-05: Crafted zone record can cause a denial of service
- PowerDNS Security Advisory 2016-04: Insufficient validation of TSIG signatures
- PowerDNS Security Advisory 2016-03: Denial of service via the web server
- PowerDNS Security Advisory 2016-02: Crafted queries can cause abnormal CPU usage
- PowerDNS Security Advisory 2016-01: Crafted queries can cause unexpected backend load
- PowerDNS Security Advisory 2015-03: Packet parsing bug can lead to crashes
- PowerDNS Security Advisory 2015-02: Packet parsing bug can cause thread or process abortion
- PowerDNS Security Advisory 2015-01: Label decompression bug can cause crashes or CPU spikes
- PowerDNS Security Advisory 2012-01: PowerDNS Authoritative Server can be caused to generate a traffic loop
- PowerDNS Security Advisory 2008-03: Some PowerDNS Configurations can be forced to restart remotely
- PowerDNS Security Advisory 2008-02: By not responding to certain queries, domains become easier to spoof
- Older security advisories
Changelogs
- Changelogs for 4.1.x
  - 4.1.1
  - 4.1.0
  - 4.1.0-rc3
  - 4.1.0-rc2
  - 4.1.0-rc1
- Changelogs for 4.0.x
- Changelogs for 3.x and older
End of life statements
- PowerDNS Authoritative Server 3.x
- PowerDNS Authoritative Server 2.x
Frequently Asked Questions
- Replication
- Operational
- Backends
Backend writers’ guide
- Notes
- Simple read-only native backends
- A sample minimal backend
- Interface definition
  - Classes
  - Methods
- Reporting errors
- Declaring and reading configuration details
- Read/write slave-capable backends
- Supermaster/Superslave capability
- Read/write master-capable backends
- DNS update support
- DNS update support
- Miscellaneous
  - ENT (Empty Non-Terminal)
Compiling PowerDNS
- Getting the sources
- Dependencies
- Optional dependencies
Cryptographic software and export control
- Specific United States Export Control Notes
Internals
- How PowerDNS translates DNS queries into backend queries
Supported Record Types
- A
- AAAA
- AFSDB
- ALIAS
- CAA
- CERT
- CDNSKEY
- CDS
- CNAME
- DNSKEY
- DNAME
- DS
- HINFO
- KEY
- LOC
- MX
- NAPTR
- NS
- NSEC, NSEC3, NSEC3PARAM
- OPENPGPKEY
- PTR
- RP
- RRSIG
- SOA
- SPF
- SSHFP
- SRV
- TKEY, TSIG
- TLSA
- SMIMEA
- TXT
- URI
- Other types