<html>Hi<br />Maybe i did not understand correct, but the AXFR zone transfer from primary to secondary should not be routed via DNSdist. from my point of view, makes no sense.<br /><br />Cheers<br /><br /><br />On Tue. 7. June 2022 10:02 CEST, Lucas Rolff via dnsdist <dnsdist@mailman.powerdns.com> wrote:<br /> <blockquote type="cite" cite="4569092C-A032-450B-8964-8E674425F730@lucasrolff.com"> </blockquote><meta http-equiv="Content-Type" content="text/html; "> Hi guys,<div> </div><div>I want to gather DNS query information from my powerdns setup, and since powerdns doesn’t support dnstap it means deploying dnsdist in front of powerdns.</div><div> </div><div>My powerdns setup has a hidden primary that cannot be queried from the outside except a small amount of IPs, and transfers from the primary to the secondary is done via AXFR and NOTIFY.</div><div> </div><div>Now, the issue is when I put dnsdist in front of powerdns, the NOTIFY calls obviously end up at dnsdist instead of powerdns, and dnsdist then pass on the NOTIFY call to powerdns running on localhost port 5300.</div><div> </div><div>Per the documentation in <a href="https://dnsdist.org/advanced/axfr.html">https://dnsdist.org/advanced/axfr.html</a> I’ve used the last “addAction” to check if NOTIFY calls come from the hidden primary, and I’ve put 127.0.0.1 in the trusted-notification-proxy setting in PowerDNS.</div><div>When NOTIFY calls arrive, the secondary tries to do a SOA check to 127.0.0.1 instead of the actual hidden primary, and I end up with:</div><div> </div><div>```</div><div><div>Jun 4 09:10:30 ns1 pdns_server[789]: Received NOTIFY for my <a href="http://domain.com"> domain.com</a> from 127.0.0.1:33941 for which we are not authoritative, trying supermaster</div><div>Jun 4 09:10:30 ns1 pdns_server[789]: Error resolving SOA or NS for <a href="http://domain.com">domain.com</a> at: 127.0.0.1: Query to '127.0.0.1' for SOA of <a href="http://domain.com">domain.com</a>' produced no answers</div></div><div>```</div><div> </div><div>Now, I could do another action that would redirect SOA, AXFR and IXFR to the primary, but ideally I don’t want that if a random client decides to do `dig <a href="http://mydomain.com">mydomain.com</a> SOA @ns1.dnsserver.com` that those queries are then redirected to the hidden primary.</div><div>Is there any way to solve this? I’d somehow have expected that the SOA query would happen towards the “real” primary that sends the NOTIFY call when trusted-notification-proxy is set, but that doesn’t seem to be the case.</div><div> </div><div>In all honesty, I’m not sure whether I have to fix something in dnsdist or powerdns, but considering I only face the issue when running dnsdist, I’m using this mailing-list.</div><div> </div><div>My end goal is that my secondaries can get updates and new zones added correctly even when dnsdist is in front, and at the same time not open up for SOA being redirected to the hidden primary for normal DNS clients querying the secondaries.</div><div> </div><div>Do anyone have pointers what could be done in this case?</div><div> </div><div>Thanks in advance, and thanks for an awesome piece of software :)</div><br /><br /> </html>