Incoming data dump: --------------------------- # Autogenerated configuration file template
################################# # ignore-unknown-settings Configuration settings to ignore if they are unknown # # ignore-unknown-settings= ################################# # 8bit-dns Allow 8bit dns queries # # 8bit-dns=no ################################# # allow-axfr-ips Allow zonetransfers only to these subnets # # allow-axfr-ips=127.0.0.0/8,::1 ################################# # allow-dnsupdate-from A global setting to allow DNS updates from these IP ranges. # # allow-dnsupdate-from=127.0.0.0/8,::1 ################################# # allow-notify-from Allow AXFR NOTIFY from these IP ranges. If empty, drop all incoming notifies. # # allow-notify-from=0.0.0.0/0,::/0 allow-notify-from= ################################# # allow-unsigned-autoprimary Allow autoprimaries to create zones without TSIG signed NOTIFY # # allow-unsigned-autoprimary=yes ################################# # allow-unsigned-notify Allow unsigned notifications for TSIG secured zones # # allow-unsigned-notify=yes ################################# # allow-unsigned-supermaster Allow supermasters to create zones without TSIG signed NOTIFY # # allow-unsigned-supermaster=yes ################################# # also-notify When notifying a zone, also notify these nameservers # # also-notify= ################################# # any-to-tcp Answer ANY queries with tc=1, shunting to TCP # # any-to-tcp=yes any-to-tcp=yes ################################# # api Enable/disable the REST API (including HTTP listener) # # api=no ################################# # api-key Static pre-shared authentication key for access to the REST API # # api-key= ################################# # autosecondary Act as an autosecondary (formerly superslave) # # autosecondary=no ################################# # axfr-fetch-timeout Maximum time in seconds for inbound AXFR to start or be idle after starting # # axfr-fetch-timeout=10 ################################# # axfr-lower-serial Also AXFR a zone from a master with a lower serial # # axfr-lower-serial=no ################################# # cache-ttl Seconds to store packets in the PacketCache # # cache-ttl=20 ################################# # carbon-instance If set overwrites the the instance name default # # carbon-instance=auth ################################# # carbon-interval Number of seconds between carbon (graphite) updates # # carbon-interval=30 ################################# # carbon-namespace If set overwrites the first part of the carbon string # # carbon-namespace=pdns ################################# # carbon-ourname If set, overrides our reported hostname for carbon stats # # carbon-ourname= ################################# # carbon-server If set, send metrics in carbon (graphite) format to this server IP address # # carbon-server= ################################# # chroot If set, chroot to this directory for more security # # chroot= ################################# # config-dir Location of configuration directory (pdns.conf) # # config-dir=/etc/powerdns ################################# # config-name Name of this virtual configuration - will rename the binary image # # config-name= ################################# # consistent-backends Assume individual domains are not divided over backends. Send only ANY lookup operations to the backend to reduce the number of lookups # # consistent-backends=no ################################# # control-console Debugging switch - don't use # # control-console=no ################################# # daemon Operate as a daemon # # daemon=no ################################# # default-api-rectify Default API-RECTIFY value for zones # # default-api-rectify=yes ################################# # default-ksk-algorithm Default KSK algorithm # # default-ksk-algorithm=ecdsa256 ################################# # default-ksk-size Default KSK size (0 means default) # # default-ksk-size=0 ################################# # default-publish-cdnskey Default value for PUBLISH-CDNSKEY # # default-publish-cdnskey= ################################# # default-publish-cds Default value for PUBLISH-CDS # # default-publish-cds= ################################# # default-soa-content Default SOA content # # default-soa-content=a.misconfigured.dns.server.invalid hostmaster.@ 0 10800 3600 604800 3600 ################################# # default-soa-edit Default SOA-EDIT value # # default-soa-edit= ################################# # default-soa-edit-signed Default SOA-EDIT value for signed zones # # default-soa-edit-signed= ################################# # default-ttl Seconds a result is valid if not set otherwise # # default-ttl=3600 ################################# # default-zsk-algorithm Default ZSK algorithm # # default-zsk-algorithm= ################################# # default-zsk-size Default ZSK size (0 means default) # # default-zsk-size=0 ################################# # direct-dnskey Fetch DNSKEY, CDS and CDNSKEY RRs from backend during DNSKEY or CDS/CDNSKEY synthesis # # direct-dnskey=no ################################# # disable-axfr Disable zonetransfers but do allow TCP queries # # disable-axfr=no ################################# # disable-axfr-rectify Disable the rectify step during an outgoing AXFR. Only required for regression testing. # # disable-axfr-rectify=no ################################# # disable-syslog Disable logging to syslog, useful when running inside a supervisor that logs stdout # # disable-syslog=no ################################# # disable-tcp Do not listen to TCP queries # # disable-tcp=no ################################# # distributor-threads Default number of Distributor (backend) threads to start # # distributor-threads=3 ################################# # dname-processing If we should support DNAME records # # dname-processing=no ################################# # dnssec-key-cache-ttl Seconds to cache DNSSEC keys from the database # # dnssec-key-cache-ttl=30 ################################# # dnsupdate Enable/Disable DNS update (RFC2136) support. Default is no. # # dnsupdate=no ################################# # domain-metadata-cache-ttl Seconds to cache zone metadata from the database # # domain-metadata-cache-ttl= ################################# # edns-subnet-processing If we should act on EDNS Subnet options # # edns-subnet-processing=no ################################# # entropy-source If set, read entropy from this file # # entropy-source=/dev/urandom ################################# # expand-alias Expand ALIAS records # # expand-alias=no ################################# # forward-dnsupdate A global setting to allow DNS update packages that are for a Slave zone, to be forwarded to the master. # # forward-dnsupdate=yes ################################# # forward-notify IP addresses to forward received notifications to regardless of master or slave settings # # forward-notify= ################################# # guardian Run within a guardian process # # guardian=no ################################# # include-dir Include *.conf files from this directory # # include-dir= ################################# # launch Which backends to launch and order to query them in # # launch= # -- jrd # http://laurent.bachelier.name/2009/03/switching-from-bind-to-powerdns-in-a-few-seconds/ # launch=bind # bind-config=/etc/bind/named.conf # bind-check-interval=300 launch=gmysql gmysql-host=localhost gmysql-user=XXXXXXXX gmysql-password=XXXXXXXX gmysql-dbname=powerdns ################################# # load-modules Load this module - supply absolute or relative path # # load-modules= ################################# # local-address Local IP addresses to which we bind # # local-address=0.0.0.0, :: ################################# # local-address-nonexist-fail Fail to start if one or more of the local-address's do not exist on this server # # local-address-nonexist-fail=yes ################################# # local-ipv6 DEPRECATED, will be removed, move your IPs to local-address # # local-ipv6= ################################# # local-port The port on which we listen # # local-port=53 local-port=5300 ################################# # log-dns-details If PDNS should log DNS non-erroneous details # # log-dns-details=no log-dns-details=yes ################################# # log-dns-queries If PDNS should log all incoming DNS queries # # log-dns-queries=no ################################# # log-timestamp Print timestamps in log lines # # log-timestamp=yes ################################# # logging-facility Log under a specific facility # # logging-facility= logging-facility=4 ################################# # loglevel Amount of logging. Higher is more. Do not set below 3 # # loglevel=4 loglevel=7 ################################# # lua-axfr-script Script to be used to edit incoming AXFRs # # lua-axfr-script= ################################# # lua-dnsupdate-policy-script Lua script with DNS update policy handler # # lua-dnsupdate-policy-script= ################################# # lua-prequery-script Lua script with prequery handler (DO NOT USE) # # lua-prequery-script= ################################# # master Act as a master # # master=no master=yes ################################# # max-cache-entries Maximum number of entries in the query cache # # max-cache-entries=1000000 ################################# # max-ent-entries Maximum number of empty non-terminals in a zone # # max-ent-entries=100000 ################################# # max-generate-steps Maximum number of $GENERATE steps when loading a zone from a file # # max-generate-steps=0 ################################# # max-nsec3-iterations Limit the number of NSEC3 hash iterations # # max-nsec3-iterations=100 ################################# # max-packet-cache-entries Maximum number of entries in the packet cache # # max-packet-cache-entries=1000000 ################################# # max-queue-length Maximum queuelength before considering situation lost # # max-queue-length=5000 ################################# # max-signature-cache-entries Maximum number of signatures cache entries # # max-signature-cache-entries= ################################# # max-tcp-connection-duration Maximum time in seconds that a TCP DNS connection is allowed to stay open. # # max-tcp-connection-duration=0 ################################# # max-tcp-connections Maximum number of TCP connections # # max-tcp-connections=20 ################################# # max-tcp-connections-per-client Maximum number of simultaneous TCP connections per client # # max-tcp-connections-per-client=0 ################################# # max-tcp-transactions-per-conn Maximum number of subsequent queries per TCP connection # # max-tcp-transactions-per-conn=0 ################################# # module-dir Default directory for modules # # module-dir=/usr/lib64/powerdns/pdns ################################# # negquery-cache-ttl Seconds to store negative query results in the QueryCache # # negquery-cache-ttl=60 ################################# # no-shuffle Set this to prevent random shuffling of answers - for regression testing # # no-shuffle=off ################################# # non-local-bind Enable binding to non-local addresses by using FREEBIND / BINDANY socket options # # non-local-bind=no ################################# # only-notify Only send AXFR NOTIFY to these IP addresses or netmasks # # only-notify=0.0.0.0/0,::/0 only-notify= ################################# # out-of-zone-additional-processing Do out of zone additional processing # # out-of-zone-additional-processing=yes ################################# # outgoing-axfr-expand-alias Expand ALIAS records during outgoing AXFR # # outgoing-axfr-expand-alias=no ################################# # overload-queue-length Maximum queuelength moving to packetcache only # # overload-queue-length=0 ################################# # prevent-self-notification Don't send notifications to what we think is ourself # # prevent-self-notification=yes ################################# # query-cache-ttl Seconds to store query results in the QueryCache # # query-cache-ttl=20 ################################# # query-local-address Source IP addresses for sending queries # # query-local-address=0.0.0.0 :: ################################# # query-local-address6 DEPRECATED: Use query-local-address. Source IPv6 address for sending queries # # query-local-address6= ################################# # query-logging Hint backends that queries should be logged # # query-logging=no ################################# # queue-limit Maximum number of milliseconds to queue a query # # queue-limit=1500 ################################# # receiver-threads Default number of receiver threads to start # # receiver-threads=1 ################################# # resolver Use this resolver for ALIAS and the internal stub resolver # # resolver=no ################################# # retrieval-threads Number of AXFR-retrieval threads for slave operation # # retrieval-threads=2 ################################# # reuseport Enable higher performance on compliant kernels by using SO_REUSEPORT allowing each receiver thread to open its own socket # # reuseport=no ################################# # rng Specify the random number generator to use. Valid values are auto,sodium,openssl,getrandom,arc4random,urandom. # # rng=auto ################################# # security-poll-suffix Domain name from which to query security update notifications # # security-poll-suffix=secpoll.powerdns.com. ################################# # send-signed-notify Send TSIG secured NOTIFY if TSIG key is configured for a domain # # send-signed-notify=yes ################################# # server-id Returned when queried for 'id.server' TXT or NSID, defaults to hostname - disabled or custom # # server-id= ################################# # setgid If set, change group id to this gid for more security # setgid=pdns ################################# # setuid If set, change user id to this uid for more security # setuid=pdns ################################# # signing-threads Default number of signer threads to start # # signing-threads=3 ################################# # slave Act as a slave # # slave=no ################################# # slave-cycle-interval Schedule slave freshness checks once every .. seconds # # slave-cycle-interval=60 ################################# # slave-renotify If we should send out notifications for slaved updates # # slave-renotify=no ################################# # socket-dir Where the controlsocket will live, /var/run/pdns when unset and not chrooted # # socket-dir= ################################# # superslave Act as a superslave # # superslave=no ################################# # tcp-control-address If set, PowerDNS can be controlled over TCP on this address # # tcp-control-address= ################################# # tcp-control-port If set, PowerDNS can be controlled over TCP on this address # # tcp-control-port=53000 ################################# # tcp-control-range If set, remote control of PowerDNS is possible over these networks only # # tcp-control-range=127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fe80::/10 ################################# # tcp-control-secret If set, PowerDNS can be controlled over TCP after passing this secret # # tcp-control-secret= ################################# # tcp-fast-open Enable TCP Fast Open support on the listening sockets, using the supplied numerical value as the queue size # # tcp-fast-open=0 ################################# # tcp-idle-timeout Maximum time in seconds that a TCP DNS connection is allowed to stay open while being idle # # tcp-idle-timeout=5 ################################# # traceback-handler Enable the traceback handler (Linux only) # # traceback-handler=yes ################################# # trusted-notification-proxy IP address of incoming notification proxy # # trusted-notification-proxy= ################################# # udp-truncation-threshold Maximum UDP response size before we truncate # # udp-truncation-threshold=1232 ################################# # upgrade-unknown-types Transparently upgrade known TYPExxx records. Recommended to keep off, except for PowerDNS upgrades until data sources are cleaned up # # upgrade-unknown-types=no ################################# # version-string PowerDNS version in packets - full, anonymous, powerdns or custom # # version-string=full ################################# # webserver Start a webserver for monitoring (api=yes also enables the HTTP listener) # # webserver=no webserver=yes ################################# # webserver-address IP Address of webserver/API to listen on # # webserver-address=127.0.0.1 webserver-address=0.0.0.0 ################################# # webserver-allow-from Webserver/API access is only allowed from these subnets # # webserver-allow-from=127.0.0.1,::1 ################################# # webserver-loglevel Amount of logging in the webserver (none, normal, detailed) # # webserver-loglevel=normal ################################# # webserver-max-bodysize Webserver/API maximum request/response body size in megabytes # # webserver-max-bodysize=2 ################################# # webserver-password Password required for accessing the webserver # # webserver-password= ################################# # webserver-port Port of webserver/API to listen on # # webserver-port=8081 ################################# # webserver-print-arguments If the webserver should print arguments # # webserver-print-arguments=no ################################# # write-pid Write a PID file # # write-pid=yes ################################# # xfr-max-received-mbytes Maximum number of megabytes received from an incoming XFR # # xfr-max-received-mbytes=100 ------------------------ MariaDB [powerdns]> select * from domains where name = 'jrd.org'; +----+---------+--------+------------+--------+-----------------+---------+ | id | name | master | last_check | type | notified_serial | account | +----+---------+--------+------------+--------+-----------------+---------+ | 5 | jrd.org | | NULL | MASTER | 2022010900 | NULL | +----+---------+--------+------------+--------+-----------------+---------+ 1 row in set (0.000 sec) MariaDB [powerdns]> select * from records where name = 'jrd.org'; +----+-----------+---------+------+-------------------------------------------------------------------------------+-------+------+----------+-----------+------+ | id | domain_id | name | type | content | ttl | prio | disabled | ordername | auth | +----+-----------+---------+------+-------------------------------------------------------------------------------+-------+------+----------+-----------+------+ | 19 | 5 | jrd.org | SOA | f3-kong-dyndns.jrd.org postmaster.jrd.org 2022010900 10800 3600 3600000 86400 | 86400 | 0 | 0 | NULL | NULL | | 20 | 5 | jrd.org | NS | f3-kong-dyndns.jrd.org | 86400 | 0 | 0 | NULL | NULL | | 21 | 5 | jrd.org | MX | kong.jrd.org | 86400 | 10 | 0 | NULL | NULL | | 22 | 5 | jrd.org | MX | g2.jrd.org | 86400 | 20 | 0 | NULL | NULL | +----+-----------+---------+------+-------------------------------------------------------------------------------+-------+------+----------+-----------+------+ 4 rows in set (0.000 sec) -------------------- root@f3-kong-dyndns /etc/powerdns # pdnsutil check-zone jrd.org Jan 18 07:15:49 gmysql Connection successful. Connected to database 'powerdns' on 'localhost'. Jan 18 07:15:49 gmysql Connection successful. Connected to database 'powerdns' on 'localhost'. Checked 92 records of 'jrd.org', 0 errors, 0 warnings. root@f3-kong-dyndns /etc/powerdns # dig jrd.org soa @localhost ; <<>> DiG 9.16.22 <<>> jrd.org soa @localhost ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58908 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;jrd.org. IN SOA ;; ANSWER SECTION: jrd.org. 86266 IN SOA f3-kong-dyndns.jrd.org. postmaster.jrd.org. 2022010900 10800 3600 3600000 86400 ;; Query time: 90 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Jan 18 07:16:32 EST 2022 ;; MSG SIZE rcvd: 98 root@f3-kong-dyndns /etc/powerdns # ------------------- From: frank+p...@tembo.be Date: Tue, 18 Jan 2022 09:46:10 +0100 Hi, The interesting parts are: - your full pdns config file (please mask passwords, but nothing besides that) - entry for that domain in the domains table - SOA / NS records in the records table for that domain - output of `pdnsutil check-zone` on that domain. That should give us a good starting point, we'll see from there... Cheers! Frank On 17 Jan 2022, at 16:51, jrd-p...@jrd.org wrote: D'oh, my bad. That must have fallen into my spam trap and I missed it. Do you want the entire contents of the DB for that zone, or just a subset like the SOA and records talking about that host? Do you want it in sql format or zone format? What I'm hoping for is a recipe: "pdns looks for a valid SOA naming the local host, and A record for itself, and [fill in the blank]. If those conditions are met, it will conlude that it's authoritative". I'll collect that stuff up. Thanks! From: frank+p...@tembo.be Date: Mon, 17 Jan 2022 14:20:50 +0100 Hi, Please see my earlier reply ( https://mailman.powerdns.com/pipermail/pdns-users/2022-January/027513.html ) Hi, Could you please paste the full configuration (pdns.conf) and the entries in the database? In particular, the things to look at would be: type of domain set, backend config, ... On top of that, can you run `pdnsutil check-zone` on the zone and paste the output? Frank On 17 Jan 2022, at 14:01, jrd via Pdns-users < pdns-users@mailman.powerdns.com> wrote: Bump. Anybody? If it's in the docs and I missed it, please point me in the right direction. TIA . . . From: jrd-p...@jrd.org Date: Sun, 9 Jan 2022 17:23:40 -0500 Hi all. I know this is a bit of a newbie question, but it seems to be stumping me. I've just set up a new pdns server. pdns 4.5.1. I populated its DB with a bunch of test records. I gave it an SOA saying it's the authority for my zone. Made sure the hostname and IP address match the local configuration of the machine. When I query it with (for instance) dig, it returns all the correct data, for the SOA or any other of my test records, but it doesn't set the AA bit. What are the criteria which have to be met, in order for pdns to say "Yep, I'm the authority for this domain" ? TIA . . . _______________________________________________ Pdns-users mailing list Pdns-users@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/pdns-users Frank Louwers PowerDNS Certified Consultant @ Kiwazo.be Frank Louwers PowerDNS Certified Consultant @ Kiwazo.be _______________________________________________ Pdns-users mailing list Pdns-users@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/pdns-users
