<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hi guys,
<div class=""><br class="">
</div>
<div class="">I want to gather DNS query information from my powerdns setup, and since powerdns doesn’t support dnstap it means deploying dnsdist in front of powerdns.</div>
<div class=""><br class="">
</div>
<div class="">My powerdns setup has a hidden primary that cannot be queried from the outside except a small amount of IPs, and transfers from the primary to the secondary is done via AXFR and NOTIFY.</div>
<div class=""><br class="">
</div>
<div class="">Now, the issue is when I put dnsdist in front of powerdns, the NOTIFY calls obviously end up at dnsdist instead of powerdns, and dnsdist then pass on the NOTIFY call to powerdns running on localhost port 5300.</div>
<div class=""><br class="">
</div>
<div class="">Per the documentation in <a href="https://dnsdist.org/advanced/axfr.html" class="">https://dnsdist.org/advanced/axfr.html</a> I’ve used the last “addAction” to check if NOTIFY calls come from the hidden primary, and I’ve put 127.0.0.1 in the trusted-notification-proxy
setting in PowerDNS.</div>
<div class="">When NOTIFY calls arrive, the secondary tries to do a SOA check to 127.0.0.1 instead of the actual hidden primary, and I end up with:</div>
<div class=""><br class="">
</div>
<div class="">```</div>
<div class="">
<div class="">Jun 4 09:10:30 ns1 pdns_server[789]: Received NOTIFY for my <a href="http://domain.com" class="">
domain.com</a> from 127.0.0.1:33941 for which we are not authoritative, trying supermaster</div>
<div class="">Jun 4 09:10:30 ns1 pdns_server[789]: Error resolving SOA or NS for <a href="http://domain.com" class="">domain.com</a> at: 127.0.0.1: Query to '127.0.0.1' for SOA of <a href="http://domain.com" class="">domain.com</a>' produced no answers</div>
</div>
<div class="">```</div>
<div class=""><br class="">
</div>
<div class="">Now, I could do another action that would redirect SOA, AXFR and IXFR to the primary, but ideally I don’t want that if a random client decides to do `dig
<a href="http://mydomain.com" class="">mydomain.com</a> SOA @ns1.dnsserver.com` that those queries are then redirected to the hidden primary.</div>
<div class="">Is there any way to solve this? I’d somehow have expected that the SOA query would happen towards the “real” primary that sends the NOTIFY call when trusted-notification-proxy is set, but that doesn’t seem to be the case.</div>
<div class=""><br class="">
</div>
<div class="">In all honesty, I’m not sure whether I have to fix something in dnsdist or powerdns, but considering I only face the issue when running dnsdist, I’m using this mailing-list.</div>
<div class=""><br class="">
</div>
<div class="">My end goal is that my secondaries can get updates and new zones added correctly even when dnsdist is in front, and at the same time not open up for SOA being redirected to the hidden primary for normal DNS clients querying the secondaries.</div>
<div class=""><br class="">
</div>
<div class="">Do anyone have pointers what could be done in this case?</div>
<div class=""><br class="">
</div>
<div class="">Thanks in advance, and thanks for an awesome piece of software :)</div>
</body>
</html>