PowerDNS Recursor¶

Introduction
- Notable features
- Getting support
Getting Started
- Installation
- Configuring the Recursor
- Using Ansible
Operating the PowerDNS Recursor
- Logging
  - Logging to syslog
- Cache Management
- Tracing Queries
Performance Guide
- Threading and distribution of queries
- Performance tips
- Connection tracking and firewalls
- Recursor Caches
- Measuring performance
Metrics and Statistics
- Regular Statistics Log
- Sending metrics to Graphite/Metronome over Carbon
- Sending metrics over SNMP
- Getting Metrics from the Recursor
  - Using the Webserver
  - Using rec_control
- Gathered Information
DNSSEC in the PowerDNS Recursor
- DNSSEC settings
- Trust Anchor Management
  - Trust Anchors
  - Negative Trust Anchors
Lua Configuration
- Managing DNSSEC Trust Anchors in the Lua Configuration
- Using Sortlist
  - addSortList
- Logging DNS messages with Protocol Buffers
- Response Policy Zones (RPZ)
Scripting The Recursor
- Configuring Lua scripts
- The DNSQuestion (dq) object
- DNSHeader Object
- The EDNSOptionView Class
- DNS names and comparing them
  - The DNSName object
  - DNS Suffix Match Groups
- DNS Record
- The ComboAddress class
- Netmasks and NetMaskGroups
  - Netmask class
  - NetMaskGroup class
- Lua Scripting and Statistics
  - Generating Metrics
  - Looking at Statistics
- Logging from the Lua scripts
- Intercepting queries with Lua
- Other functions
Built-in Webserver and HTTP API
- Data format
- Server
- Zones
  - Zone
  - RRSet
  - RREntry
  - Comment
- ConfigSetting
- StatisticItem
- Webserver
- Enabling the API
- URL Endpoints
DNS64 support
Security of the PowerDNS Recursor
- PowerDNS Security Policy
  - HackerOne
  - Disclosure Policy
- Anti-spoofing
- Throttling
- Security Polling
  - Details
PowerDNS Recursor Settings
- aaaa-additional-processing
- allow-from
- allow-from-file
- any-to-tcp
- api-config-dir
- api-key
- api-readonly
- api-logfile
- auth-can-lower-ttl
- auth-zones
- carbon-interval
- carbon-ourname
- carbon-server
- chroot
- client-tcp-timeout
- config-dir
- config-name
- cpu-map
- daemon
- delegation-only
- disable-packetcache
- disable-syslog
- dnssec
  - off
  - process-no-validate
  - process
  - log-fail
  - validate
- dnssec-log-bogus
- dont-query
- ecs-add-for
- ecs-ipv4-bits
- ecs-ipv6-bits
- ecs-scope-zero-address
- edns-outgoing-bufsize
- edns-subnet-whitelist
- entropy-source
- etc-hosts-file
- export-etc-hosts
- export-etc-hosts-search-suffix
- forward-zones
- forward-zones-file
- forward-zones-recurse
- gettag-needs-edns-options
- hint-file
- include-dir
- latency-statistic-size
- local-address
- local-port
- log-timestamp
- non-local-bind
- loglevel
- log-common-errors
- log-rpz-changes
- logging-facility
- lowercase-outgoing
- lua-config-file
- lua-dns-script
- max-cache-entries
- max-cache-ttl
- max-mthreads
- max-packetcache-entries
- max-qperq
- max-negative-ttl
- max-recursion-depth
- max-tcp-clients
- max-tcp-per-client
- max-tcp-queries-per-connection
- max-total-msec
- minimum-ttl-override
- network-timeout
- nsec3-max-iterations
- packetcache-ttl
- packetcache-servfail-ttl
- pdns-distributes-queries
- query-local-address
- query-local-address6
- quiet
- reuseport
- root-nx-trust
- security-poll-suffix
- serve-rfc1918
- server-down-max-fails
- server-down-throttle-time
- server-id
- setgid, setuid
- single-socket
- snmp-agent
- snmp-master-socket
- socket-dir
- socket-owner, socket-group, socket-mode
- spoof-nearmiss-max
- stack-size
- statistics-interval
- stats-ringbuffer-entries
- tcp-fast-open
- threads
- trace
- udp-truncation-threshold
- use-incoming-edns-subnet
- version
- version-string
- webserver
- webserver-address
- webserver-allow-from
- webserver-password
- webserver-port
- write-pid
- xpf-allow-from
- xpf-rr-code
Manual Pages
- pdns_recursor
  - Synopsis
  - Description
  - Examples
  - Options
  - See also
- rec_control
  - Synopsis
  - Description
  - Examples
  - Options
  - Commands
  - See also
Security Advisories
- PowerDNS Security Advisory 2018-01: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2017-08: Crafted CNAME answer can cause a denial of service
- PowerDNS Security Advisory 2017-07: Memory leak in DNSSEC parsing
- PowerDNS Security Advisory 2017-06: Configuration file injection in the API
- PowerDNS Security Advisory 2017-05: Cross-Site Scripting in the web interface
- PowerDNS Security Advisory 2017-03: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2016-04: Insufficient validation of TSIG signatures
- PowerDNS Security Advisory 2016-02: Crafted queries can cause abnormal CPU usage
- PowerDNS Security Advisory 2015-01: Label decompression bug can cause crashes or CPU spikes
- PowerDNS Security Advisory 2014-02: PowerDNS Recursor 3.6.1 and earlier can be made to provide bad service
- PowerDNS Security Advisory 2014-01: PowerDNS Recursor 3.6.0 can be crashed remotely
- PowerDNS Security Advisory 2010-02: PowerDNS Recursor up to and including 3.1.7.1 can be spoofed into accepting bogus data
- PowerDNS Security Advisory 2010-01: PowerDNS Recursor up to and including 3.1.7.1 can be brought down and probably exploited
- PowerDNS Security Advisory 2008-01: System random generator can be predicted, leading to the potential to ‘spoof’ PowerDNS Recursor
- PowerDNS Security Advisory 2006-02: Zero second CNAME TTLs can make PowerDNS exhaust allocated stack space, and crash
- PowerDNS Security Advisory 2006-01: Malformed TCP queries can lead to a buffer overflow which might be exploitable
- Older security advisories
Upgrade Guide
- 4.1.x to 4.2.0 or master
- 4.0.x to 4.1.0
- 4.0.3 to 4.0.4
- 4.0.0 to 4.0.1
Changelogs
- Changelogs for 4.1.x
  - 4.1.1
  - 4.1.0
  - 4.1.0-rc3
  - 4.1.0-rc2
  - 4.1.0-rc1
  - 4.1.0-alpha1
- Changelogs for 4.0.x
- Changelogs for all pre 4.0 releases
End of life statements
Compiling the PowerDNS Recursor
- Getting the sources
- Dependencies
- Optional dependencies
Cryptographic software and export control
- Specific United States Export Control Notes
Internals of the PowerDNS Recursor
- The PowerDNS Recursor
- Synchronous code using MTasker
- MPlexer
- MOADNSParser
- The C++ Standard Library / Boost
- Actual DNS Algorithm
  - The non-cached case
- Some of the things we glossed over
- The Recursor Cache
- Some small things