[dnsdist] PowerDNS DNSdist 1.9.3 released

-1.9.3.tar.bz2 [6]: https://downloads.powerdns.com/releases/dnsdist-1.9.3.tar.bz2.sig [7]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature

Re: [dnsdist] 1.9.2 crashing in tcpClient

Hi Holger, Thanks for reaching out. We have had another report already and are looking into it. We have already confirmed that reverting a recent change fixes it [1], and we will release 1.9.3 in a couple hours. [1]: https://github.com/PowerDNS/pdns/pull/14040/files Best regards, -- Remi

[dnsdist] PowerDNS DNSdist 1.9.2 released

[5]: https://downloads.powerdns.com/releases/dnsdist-1.9.2.tar.bz2 [6]: https://downloads.powerdns.com/releases/dnsdist-1.9.2.tar.bz2.sig [7]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital

Re: [dnsdist] [EXT] Re: PowerDNS DNSdist 1.9.1 released

in case of error reports as everyone would be able to use the same build artefacts). We are actually in the process of evaluating several options to do just that, but I don't have an ETA at this point. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc

Re: [dnsdist] DoH issues after 1.8.3 -> 1.9.0 upgrade

TP/1.1 if it serves a real purpose, I just don't want to increase the code complexity and attack surface just to reply to crawlers.. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___

Re: [dnsdist] DoH issues after 1.8.3 -> 1.9.0 upgrade

Hi Christoph, In addition to the issue mentioned by Otto, it might also be that the monitoring does not support HTTP/2. The new nghttp2 provider for incoming DNS over HTTPS does not support HTTP/1.1. In 1.9.x it's still possible to switch back to the legacy h2o provider but note that it will

[dnsdist] PowerDNS DNSdist 1.9.1 released

://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

[dnsdist] PowerDNS DNSdist 1.9.0

/dnsdist-1.9.0.tar.bz2 [17]: https://downloads.powerdns.com/releases/dnsdist-1.9.0.tar.bz2.sig [18]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature

Re: [dnsdist] Empty NOERROR being sent when backend times out

as the issue is infrequent, but am I on the right track? Is it possible to make dnsdist respond with a SERVFAIL for a backend timeout? Nope. [1]: https://dnsdist.org/guides/serverselection.html#setServFailWhenNoServer Hope that helps, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com

[dnsdist] PowerDNS DNSdist 1.9.0-rc1 released

/upgrade_guide.html#x-to-1-9-0-rc1 [6]: https://github.com/PowerDNS/pdns/issues/new/choose [7]: https://downloads.powerdns.com/releases/dnsdist-1.9.0-rc1.tar.bz2 [8]: https://downloads.powerdns.com/releases/dnsdist-1.9.0-rc1.tar.bz2.sig [9]: https://repo.powerdns.com Best regards, -- Remi Gacogne

Re: [dnsdist] [EXT] AW: Suggestions for rules to block abusive traffic

DNS server. Of course most of the difficulty lies in automated this, which is very specific to every setup. -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___ dnsdist mailing li

Re: [dnsdist] [EXT] AW: Suggestions for rules to block abusive traffic

why the LMDB backend has been implemented, along with lightningstream :) [1]: https://github.com/PowerDNS/pdns/issues/13374 Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___

Re: [dnsdist] Suggestions for rules to block abusive traffic

with the results. Best regards, [1]: https://dnsdist.org/reference/config.html#DynBlockRulesGroup:setSuffixMatchRule -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature

[dnsdist] PowerDNS DNSdist 1.8.3 released

/upgrade_guide.html#x-to-1-8-3 [4]: https://github.com/PowerDNS/pdns/issues/new/choose [5]: https://downloads.powerdns.com/releases/dnsdist-1.8.3.tar.bz2 [6]: https://downloads.powerdns.com/releases/dnsdist-1.8.3.tar.bz2.sig [7]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https

[dnsdist] PowerDNS DNSdist 1.9.0-alpha4 released

/upgrade_guide.html#x-to-1-9-0-alpha4 [5]: https://github.com/PowerDNS/pdns/issues/new/choose [6]: https://downloads.powerdns.com/releases/dnsdist-1.9.0-alpha4.tar.bz2 [7]: https://downloads.powerdns.com/releases/dnsdist-1.9.0-alpha4.tar.bz2.sig [8]: https://repo.powerdns.com Best regards, -- Remi Gacogne

Re: [dnsdist] [EXT] Re: Question about implementing dynBlockRulesGroup

ua [1]. [1]: https://dnsdist.org/advanced/luaaction.html Hope that helps, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://

Re: [dnsdist] Compiling with DNS-over-QUIC on OpenSUSE - quiche not found

to compile because of missing symbols. Perhaps there should be an additional check that TLS is enabled a pre-requisite of QUIC, or a change so that QUIC automatically implies TLS as well? I can reproduce that, and this is indeed a bug. I'll get it fixed, thanks! Best regards, -- Remi Gacogne

Re: [dnsdist] addAction OpCode Iquery

the qdcount==0 behaviour configurable, to allow dropping or sending a custom response code (Refused? No Error?) instead of Not Implemented. Opening a feature request would go a long way to make it happen :) [1]: https://github.com/PowerDNS/pdns/pull/9991 Best regards, -- Remi Gacogne PowerDNS.COM

Re: [dnsdist] rmResponseRule("name") not working

st regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

Re: [dnsdist] Compiling with DNS-over-QUIC on OpenSUSE - quiche not found

/pkgconfig to PKG_CONFIG_PATH for Quiche to be detected. Can you try setting PKG_CONFIG_PATH=/usr/lib/pkgconfig:/usr/lib64/pkgconfig at the end of your configure line? [1]: https://github.com/PowerDNS/pdns/blob/master/builder-support/specs/dnsdist.spec#L108 -- Remi Gacogne PowerDNS.COM BV - https

Re: [dnsdist] Question about implementing dynBlockRulesGroup

dnsdist.org/rules-actions.html#MaxQPSIPRule Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

[dnsdist] PowerDNS DNSdist 1.9.0-alpha3 released

/dnsdist-1.9.0-alpha3.tar.bz2 [11]: https://downloads.powerdns.com/releases/dnsdist-1.9.0-alpha3.tar.bz2.sig [12]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature

Re: [dnsdist] Is it possible to setup a SpoofAction/SpoofCNAME action for a listening address?

to match queries sent to a specific of listening addresses, setting the 'src' parameter of 'NetmaskGroupRule'[1] to false should do what you want. [1]: https://dnsdist.org/rules-actions.html?highlight=suffixmatch#NetmaskGroupRule -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com

[dnsdist] PowerDNS DNSdist 1.7.5 and 1.8.2 released

://downloads.powerdns.com/releases/dnsdist-1.7.5.tar.bz2 [7]: https://downloads.powerdns.com/releases/dnsdist-1.8.2.tar.bz2 [8]: https://downloads.powerdns.com/releases/dnsdist-1.7.5.tar.bz2.sig [9]: https://downloads.powerdns.com/releases/dnsdist-1.8.2.tar.bz2.sig [10]: https://repo.powerdns.com Best regards, -- Remi

Re: [dnsdist] dnsdist 1.7.4 Debian Bullseye vs 1.8.4 Bullseye

so I would be really interested in seeing the perf output if you can get it. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___ dnsdist mailing list dnsd

Re: [dnsdist] greqp() output columns

   RD    No Error. 0 answers does "T.O" in the Lat. column stand for timeout? Yes, it means that dnsdist believes it did not get a response from the backend in time. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ _

Re: [dnsdist] backend drops metrics for TCP

the dnsdist console set up, you can use grepq('1000ms') to look at all queries that took more than 1 second, which is usually indicative of a problem, or even grepq('2000ms'), as dnsdist records timeouts with a very high response time. Best regards, -- Remi Gacogne PowerDNS.COM BV - https

Re: [dnsdist] dnsdist latency bucket metric still broken in 1.8.0?

is that we were not expecting as much scrutiny over the DoT/DoH latency as with the UDP one. I am very willing to add latency-bucket for DoT, DoH and the upcoming DoQ, so I have put the issue you opened into the 1.9 milestone. Thanks! -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com

Re: [dnsdist] dnsdist 1.7.4 Debian Bullseye vs 1.8.4 Bullseye

) then running 'perf record --call-graph dwarf -p -o ' for a few dozens of seconds to collect a trace, stopping it with Ctrl+C and finally getting a report with "perf report -i --stdio". It should tell us where the CPU usage is going. Best regards, -- Remi Gacogne PowerDNS.COM

Re: [dnsdist] Does dnsdist try the next server inside a pool, when the first does not answer?

applications/stub resolvers will retry quite quickly over UDP, often before 2 seconds which is the default value of setUDPTimeout, and thus it does not make sense to increase the load on the backend. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc

[dnsdist] PowerDNS DNSdist 1.9.0-alpha1 released

/issues/new/choose [6]: https://downloads.powerdns.com/releases/dnsdist-1.9.0-alpha1.tar.bz2 [7]: https://downloads.powerdns.com/releases/dnsdist-1.9.0-alpha1.tar.bz2.sig [8]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com

Re: [dnsdist] backend drops metrics for TCP

point of view there was no need for more TCP connections, apparently. Do you enable out-of-order processing, via 'maxInFlight' on `newServer`? If so, are you sure that the backend actually supports it? Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdn

Re: [dnsdist] Dnsdist as high availability mode

it work, which is why it's not mentioned in the documentation. We will of course accept pull requests updating the documentation if you find out that some parts could use some words, though :) Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc

[dnsdist] PowerDNS DNSdist 1.8.1 released

://repo.powerdns.com -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

Re: [dnsdist] Matching corrupt DNS queries?

, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature.asc Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

Re: [dnsdist] dnsdist 1.8.0 thread spinning

On 15/07/2023 09:42, Otto Moerbeek via dnsdist wrote: This is likely https://github.com/PowerDNS/pdns/pull/12726 ATM this is not marked for backporting to 1.8.x. Don't know if that is an omission. It was, I added the 'backport to dnsdist-1.8.x' flag in the meantime. Thanks! -- Remi Gacogne

Re: [dnsdist] Exclude domains with dynBlockRulesGroup ?

the excludeDomains directive apply to these rules to prevent a domain and its children from being blocked. So you cannot exclude an IP or a range from setSuffixMatchRule/setSuffixMatchRuleFFI, and neither can you exclude a domain from the other rules. I hope that helps! Best regards, -- Remi Gacogne

Re: [dnsdist] [EXT] Re: Some statistics I would like to have

received over DoT and DoH are forwarded in the same way. I wonder why the latency numbers are so different. Perhaps we are seeing different query patterns between DoT and DoH clients? -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signatur

Re: [dnsdist] Some statistics I would like to have

has been configured as TCP-only, DoT or DoH. So it might be why you are seeing a difference, although this usually tends to be the other way around with DoH being faster than DoT because DNS servers have historically been optimized for UDP. -- Remi Gacogne PowerDNS.COM BV - http

Re: [dnsdist] dnsdist restrict udp source port

ill be used to reach the backend, but this will not not work if you want to use more than one source port using the 'sockets' parameter, and more importantly will prevent dnsdist from opening more than one TCP connection to the backend which is very likely not what you want. Best regards, -- Remi

Re: [dnsdist] dnsdist latency bucket metric still broken in 1.8.0?

Hi Christoph, On 14/04/2023 17:04, Christoph via dnsdist wrote: here is our dnsdist.conf, maybe it helps to reproduce the issue. If I'm not mistaken, you are mostly dealing with DoT and DoH queries, not UDP ones? I'm asking because since 1.8 these latency metrics are now only updated for

Re: [dnsdist] dnsdist latency bucket metric still broken in 1.8.0?

ur FreeBSD servers, not our Debian based dnsdist instances. That's weird. Would you be able to share the prometheus output, or the dumpStats() one, so we know if this is the same bug or a related one? Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP

Re: [dnsdist] dnsdist 1.7 : allow only A request

st regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

[dnsdist] Third Release Candidate of PowerDNS DNSdist 1.8.0

Hello! We are very happy to release the third candidate of what will become dnsdist 1.8.0! This release contains fixes for several issues that were found in the second release candidate. - #12641: Use the correct source address when harvesting failed - #12639: Fix a race when a

[dnsdist] Second Release Candidate of PowerDNS DNSdist 1.8.0

]: https://downloads.powerdns.com/releases/dnsdist-1.8.0-rc2.tar.bz2.sig [7]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing

Re: [dnsdist] Define from which source dnsdist is sending a reply

], and the fix in [2])? If so, we will release -rc2 next week. [1]: https://github.com/PowerDNS/pdns/issues/12581 [2]: https://github.com/PowerDNS/pdns/pull/12586 -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature

Re: [dnsdist] First release candidate of dnsdist 1.8.0

and will issue a rc2 somewhere next week. Thanks! [1]: https://github.com/PowerDNS/pdns/issues/12581 [2]: https://github.com/PowerDNS/pdns/pull/12586 -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature

[dnsdist] First release candidate of dnsdist 1.8.0

/upgrade_guide.html#x-to-1-8-0 [8]: https://github.com/PowerDNS/pdns/issues/new/choose [9]: https://downloads.powerdns.com/releases/dnsdist-1.7.2.tar.bz2 [10]: https://downloads.powerdns.com/releases/dnsdist-1.7.2.tar.bz2.sig [11]: https://repo.powerdns.com -- Remi Gacogne PowerDNS.COM BV - https

Re: [dnsdist] [EXT] Re: Performance/tuning sanity check

that I would like to implement in dnsdist. It will likely have to wait until 1.9, so around Q3 this year, unless someone beats me to it :) Please report back with your findings, as it is really helpful to hear about different setups than the ones we already do our performance testing on. -

Re: [dnsdist] Performance/tuning sanity check

involve disabling IRQ balance and directly assigning the IRQ affinity for the NIC queues) Hope that helps, [1]: https://dnsdist.org/reference/tuning.html#setUDPSocketBufferSizes [2]: see the cpus option on https://dnsdist.org/reference/config.html#addLocal -- Remi Gacogne PowerDNS.COM BV - https

Re: [dnsdist] Handling lack of caching of TC responses

a feature request on GH [1] so we can track this? I would also happily merge a corresponding pull request, of course :) Thanks! [1]: https://github.com/PowerDNS/pdns/issues/new/choose Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenP

Re: [dnsdist] Responding from cache when all pool servers are down?

the result on a hit - forward the query to an available server in the selected pool, if any - return a ServFail response if there is no available server in the selected pool [1]: https://dnsdist.org/guides/serverselection.html?#setServFailWhenNoServer -- Remi Gacogne PowerDNS.COM BV - https

Re: [dnsdist] Client query id in the dq-object?

t as it touches the way dnsdist matches the responses received to the backend against the outstanding queries, so that logic is quite deep in the core code of dnsdist. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signatur

Re: [dnsdist] expungeByName from ALL pools

he list of all the existing pools, though. Would you mind opening a feature request on GH so that idea doesn't get lost? Cheers, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature _

Re: [dnsdist] Backend Questions

e to avoid breaking compatibility with existing setups, both for the configuration files and for the metrics, but we might have to make a breaking change in a new major version. [1]: https://dnsdist.org/quickstart.html#changing-server-settings -- Remi Gacogne PowerDNS.COM BV - https://www.po

Re: [dnsdist] Whitelisting IP addresses with XDP filtering

into this quickly. If you, or someone else, wants to tackle it and open a pull request I think the second option I listed in the ticket should be fairly straight-forward to implement. [1]: https://github.com/PowerDNS/pdns/issues/12061 Cheers, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com

Re: [dnsdist] Whitelisting IP addresses with XDP filtering

e using [1] to make sure that this is really the root cause of your issue. [1]: https://dnsdist.org/reference/config.html#DynBlockRulesGroup:excludeRange Best, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital

Re: [dnsdist] "Timeout from remote TCP client" with dnsdist + PDNS Recursor

not share the version of the recursor you are using, but in recent version this warning is only written to the logs when 'log-common-errors' is set to 'yes'. [1]: https://dnsdist.org/reference/tuning.html#setMaxCachedTCPConnectionsPerDownstream -- Remi Gacogne PowerDNS.COM BV - https

Re: [dnsdist] TCP / UDP backend queries

, only falling back to TCP if the answer is truncated, but this will not be before 1.9 so somewhere next year. Best, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing

[dnsdist] dnsdist 1.7.2 released

://downloads.powerdns.com/releases/dnsdist-1.7.2.tar.bz2.sig [6]: https://repo.powerdns.com -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com

[dnsdist] dnsdist 1.7.1 released

]: https://downloads.powerdns.com/releases/dnsdist-1.7.1.tar.bz2.sig [7]: https://repo.powerdns.com -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist

Re: [dnsdist] [EXT] Re: How to best handle DNS floods

d use-case, of course, so please feel free to open a feature request on GitHub and I'll try to implement that in the next version. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital

Re: [dnsdist] Best practice to handle massive DNS-JSON requests on DoH frontend

to do better, unless you can find something in the initial TCP packets or TLS handshake that can be used to identify that traffic. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature

Re: [dnsdist] [EXT] Re: How to best handle DNS floods

uld I contact to get pricing details? The easiest option is likely to go to https://www.open-xchange.com/products/dnsdist/?hsLang=en and click "Contact OX", and someone from our team should get back to you quickly. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.pow

Re: [dnsdist] Proxy protocol question

t (C) 1994-2022 Lua.org, PUC-Rio > a = true > print(a) true > a = True > print(a) nil > Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

Re: [dnsdist] How to best handle DNS floods

al services. [1]: https://dnsdist.org/reference/config.html#DynBlockRulesGroup:setRCodeRate [2]: https://dnsdist.org/reference/config.html#DynBlockRulesGroup:setRCodeRatio [3]: https://github.com/PowerDNS/pdns/pull/10498 Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/

Re: [dnsdist] [EXT] Is there some simple issue that needs to be done?

://github.com/PowerDNS/pdns/issues/10769 - https://github.com/PowerDNS/pdns/issues/9690 - https://github.com/PowerDNS/pdns/issues/11261 Please drop a comment either here or directly on the related GitHub issue if you start working on something to avoid duplicated work. I tried to contact Remi Gacogne

Re: [dnsdist] dnsdist[29321]: Marking downstream IP:53 as 'down'

ad, but it might also be caused by a network issue, like a link reaching its maximum capacity, or by dnsdist itself being overwhelmed and needing tuning (like increasing the number of newServer() directives, see [1]). [1]: https://dnsdist.org/advanced/tuning.html#udp-and-incoming-dns-over-https

Re: [dnsdist] [EXT] Re: How to apply dynamic rules with pools?

st already helps a lot :) Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

Re: [dnsdist] How to apply dynamic rules with pools?

but that's a different matter :) Hope that helps, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

Re: [dnsdist] dnsdist and powerdns on same machine

point me in the right direction? Well it is, usually, as simple as that, so if that's not working for you I'm afraid you will have to tell us more about your exact setup. Sharing the configurations of both dnsdist and pdns would be a good start. Best regards, -- Remi Gacogne PowerDNS.COM BV

Re: [dnsdist] dnsdist and PROXYv2 testing - accepting TCP connections when an upstream server is available

]: https://dnsdist.org/reference/config.html?highlight=setup#Server:setUp [2]: https://dnsdist.org/guides/webserver.html?highlight=api#get--api-v1-servers-localhost-pool?name=pool-name [3]: https://dnsdist.org/guides/serverselection.html#setServFailWhenNoServer Best regards, -- Remi Gacogne PowerDNS.COM

Re: [dnsdist] forwarding domains to special servers

e second one if you want to be able to alter the list at runtime, via the console. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

Re: [dnsdist] [EXT] XDP/eBPF blocking (was dnsdist 1.7.0 released)

directory :-) Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

[dnsdist] dnsdist 1.7.0 released

es/dnsdist-1.7.0.tar.bz2 [5]: https://downloads.powerdns.com/releases/dnsdist-1.7.0.tar.bz2.sig [6]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital

Re: [dnsdist] frontend responses for resolver timeouts

as the client uses? If we are in the rare position to know the client's timeout. (dnsdist is not under heavy load) It would make sense if you know the client's timeout duration and do understand why the backend takes so long to answer, yes. Best regards, -- Remi Gacogne PowerDNS.COM BV - https

Re: [dnsdist] frontend responses for resolver timeouts

does not properly respond to health-check queries, provided that setServFailWhenNoServer is set [1]. In that case both the 'no-policy' and 'frontend-servfail' counters will be increased. [1]: https://dnsdist.org/guides/serverselection.html#setServFailWhenNoServer Hope that helps, -- Remi Gacogne

Re: [dnsdist] no ipv6 connectivity

is my config, modified to avoid public addresses: setLocal('10.150.33.2') addLocal('2001:xxx::33::2') Did you change the default ACL? It allows 10.0.0.0/8 but only a few IPv6 prefixes: - ::1/128 - fc00::/7 - fe80::/10 https://dnsdist.org/advanced/acl.html Best regards, -- Remi Gacogne

[dnsdist] First release release of dnsdist 1.7.0

://downloads.powerdns.com/releases/dnsdist-1.7.0-rc1.tar.bz2 [5]: hhttps://downloads.powerdns.com/releases/dnsdist-1.7.0-rc1.tar.bz2.sig [6]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature

Re: [dnsdist] Large domain list blocking via DNS

/advanced/luaaction.html [2]: https://dnsdist.org/reference/constants.html#dnsaction [3]: https://github.com/PowerDNS/pdns/blob/7285a16693f67287c0d8151afbcefb7190b63cf3/regression-tests.dnsdist/test_Spoofing.py#L406 [4]: https://dnsdist.org/reference/kvs.html Hope that helps, -- Remi Gacogne

Re: [dnsdist] Dynamic Rule for abusive SERVFAIL queries from bots

https://dnsdist.org/reference/config.html?highlight=setrcode#DynBlockRulesGroup:setRCodeRatio Hope that helps, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist

Re: [dnsdist] Tune DNSDIST for proper traffic diversion and caching for lower latency

cketBufferSize [3]: https://dnsdist.org/advanced/tuning.html#udp-and-incoming-dns-over-https Best, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.p

[dnsdist] Second beta release of dnsdist 1.7.0

]: https://github.com/PowerDNS/pdns/issues/new/choose [4]: https://downloads.powerdns.com/releases/dnsdist-1.7.0-beta2.tar.bz2 [5]: hhttps://downloads.powerdns.com/releases/dnsdist-1.7.0-beta2.tar.bz2.sig [6]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https

[dnsdist] First beta release of dnsdist 1.7.0

/issues/new/choose [4]: https://downloads.powerdns.com/releases/dnsdist-1.7.0-beta1.tar.bz2 [5]: hhttps://downloads.powerdns.com/releases/dnsdist-1.7.0-beta1.tar.bz2.sig [6]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature

Re: [dnsdist] dnsdist using loopback address as source address for queries

nal timing or duration factor though, as I've not yet been able to trigger the issue on demand. Depending on how quickly that happens when you bound the backend up and down, do you think you might be able to strace the dnsdist process at the same time? Best regards, -- Remi Gacogne PowerDNS.COM

Re: [dnsdist] dnsdist to limit requests per domain

] (which is much more efficient than a regular expression) combined with a MaxQPSRule [2], for example. [1]: https://dnsdist.org/rules-actions.html#SuffixMatchNodeRule [2]: https://dnsdist.org/rules-actions.html#MaxQPSRule Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com

Re: [dnsdist] dnsdist using loopback address as source address for queries

On 10/29/21 15:32, Adam Bishop via dnsdist wrote: On 29 Oct 2021, at 13:38, Remi Gacogne via dnsdist wrote: Would you mind checking that you still have IPv6 addresses on that interface? I see you still have some on the incoming interface, though, since we receive a query over IPv6 on file

Re: [dnsdist] dnsdist using loopback address as source address for queries

On 10/29/21 13:04, Adam Bishop via dnsdist wrote: On 29 Oct 2021, at 11:33, Remi Gacogne via dnsdist wrote: would you mind getting the output of "lsof -n -p " while the issue is still happening? A full backtrace with gdb might also be good to have Sure that's fine, output fol

Re: [dnsdist] dnsdist using loopback address as source address for queries

Hi Adam, On 10/29/21 12:10, Adam Bishop via dnsdist wrote: On 13 Sep 2021, at 13:47, Adam Bishop wrote: On 13 Sep 2021, at 13:31, Remi Gacogne via dnsdist wrote: That's very weird, I don't have any clue to what might be happening. Would you mind sharing the whole configuration

Re: [dnsdist] Modify EDNS NSID response back to client

, of course :-/ Best, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

[dnsdist] Second alpha release of dnsdist 1.7.0

://downloads.powerdns.com/releases/dnsdist-1.7.0-alpha2.tar.bz2 [5]: hhttps://downloads.powerdns.com/releases/dnsdist-1.7.0-alpha2.tar.bz2.sig [6]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature

Re: [dnsdist] please consider generating a hashed one using 'hashPassword()'

hanks a lot! Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

Re: [dnsdist] DoH pool servers and packet cache usage

Hi Denis, On 10/1/21 09:07, dmachard via dnsdist wrote: I am trying to use DoH backends the new alpha release of dnsdist 1.7.0 I had a behavior I don’t understand with the packet cache, here the configuration used: [...] With this configuration, I don’t succeed to use the packet cache with

Re: [dnsdist] [EXT] Re: Dynamic rule NXDomain

configuration? Please we aware that we need to have enough queries and responses in our ring buffers to get consistent results, at described by Denis Machard in [1]. Perhaps that might be your issue? [1]: https://mailman.powerdns.com/pipermail/dnsdist/2021-September/001111.html Best regards,

Re: [dnsdist] print the ip address that match a Packet Actions

Hi Antoine, On 9/27/21 14:00, antoine blin via dnsdist wrote: I'm using the rule : "addAction(MaxQPSIPRule(5), DropAction())" and I'm wondering if it is possible to see, through the console API or other API, the list of subnet in which rate limit rule is applied. Not directly, I'm afraid,

Re: [dnsdist] Dynamic rule NXDomain

not happen that way. I hope that helps. Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman/listinfo/dnsdist

[dnsdist] First alpha release of dnsdist 1.7.0

/choose [4]: https://downloads.powerdns.com/releases/dnsdist-1.7.0-alpha1.tar.bz2 [5]: hhttps://downloads.powerdns.com/releases/dnsdist-1.7.0-alpha1.tar.bz2.sig [6]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Descriptio

[dnsdist] dnsdist 1.6.1 released

]: https://repo.powerdns.com Best regards, -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital signature ___ dnsdist mailing list dnsdist@mailman.powerdns.com https://mailman.powerdns.com/mailman

Re: [dnsdist] DynBlockRulesGroup > setQueryRate not triggered

can spare the time, of course :) By the way, many thanks for this great product! You are welcome, and many thanks to you for helping make it even better! Best -- Remi Gacogne PowerDNS.COM BV - https://www.powerdns.com/ OpenPGP_signature Description: OpenPGP digital

Re: [dnsdist] dnsdist using loopback address as source address for queries

Hi Adam, On 9/10/21 00:50, Adam Bishop via dnsdist wrote: After running for some amount of time (seems to be days), our dnsdist instances suddenly start trying to talk to the backends using the loopback address as the source: # tcpdump -i ens192 -nn port 53 dropped privs to tcpdump tcpdump:

  1   2   3   >