<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Leen,<div><br></div><div>Hopefully a few last questions and I will attempt to keep it brief. I am just having confusion on how to get the recursor servers to lookup from pdns with my configuration. I get that being authoritative for a domain will initiate a lookup to the defined dns server. How do I get a lookup and not expose the pdns software to the net and get the answers through recursor.</div><div><br></div><div>Currently this is my setup:</div><div><br></div><div>Each of my dns servers runs pdns and each has a slave copy of the master pdns mysql database and in turn each server looks up the dns locally via mysql. This has been working great for 2 years.</div><div><br></div><div>The problem each server is running pdns which has a DOS vulnerability. which is why I am upgrading to implement recursor.</div><div>ns1@<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://mydomain.com">mydomain.com</a> - on server 1</div><div>ns2@<a href="http://mydomain.com">mydomain.com</a> - on server 2</div><div>ns3@<a href="http://mydomain.com">mydomain.com</a> - on server 3</div><div><div><a href="mailto:ns3@mydomain.com">ns3@mydomain.com</a> - on server 4</div></div><div><br></div><div>Also for testing I have ns5 setup on a new server running both pdns(5300) and recursor (53). The pdns software from my research and security testing still has the DOS issue. So when recursor is on ns5 responding to port 53 requests it passes the security testing.</div><div><br></div><div><br></div><div>New Setup question:</div><div><br></div><div>My plan is to install recursor on each of the ns1,ns2,ns3, and ns4 servers and then install pdns onto the fifth server (currently ns5). Should pdns on each be responding to port 53 requests only from ns1-4 on port 53? In doing this then I only have one databases connection supporting the ns1-4 servers and now do not need the mysql slaves on each server. Currently all my hosting domains are pointing to ns1-4.</div><div><br></div><div>So does each server ns1-4 need a forward definition to lookup on the ns5 pdns server to get the authoritative response?</div><div><br></div><div>I was hoping to keep the data local to each server. Since I set it up originally this way the dns servers have been running great. I am attempting to avoid a single point of failure with my setup.</div><div><br></div><div>Thanks in advance. Like I said previously I think I am just missing a piece of the pie to get it all together.</div><div><br></div><div>Patrick</div><div><br></div><div><br></div><div><br></div><div>
<br><div><div>On Dec 22, 2010, at 3:00 AM, <a href="mailto:pdns-users-request@mailman.powerdns.com">pdns-users-request@mailman.powerdns.com</a> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Verdana; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">From: Leen Besselink <<a href="mailto:leen@consolejunkie.net">leen@consolejunkie.net</a>><br>Subject: Re: [Pdns-users] Recursor / pdns installation help<br>To:<span class="Apple-converted-space"> </span><a href="mailto:pdns-users@mailman.powerdns.com">pdns-users@mailman.powerdns.com</a><br>Message-ID: <<a href="mailto:4D1145F4.1080909@consolejunkie.net">4D1145F4.1080909@consolejunkie.net</a>><br>Content-Type: text/plain; charset=ISO-8859-1<br><br>On 12/21/2010 09:09 PM, Patrick Coffin wrote:<br><blockquote type="cite">Leen,<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Thanks for the reply. We are hosting 1000's of dns records so<br></blockquote><blockquote type="cite">entering them in the forwards is not at option.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I will take your advise to split the pdns and recursor to separate<br></blockquote><blockquote type="cite">servers.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Should I expect that if I move the pdns to a separate server that the<br></blockquote><blockquote type="cite">looks up will work correctly with the information I have given? I<br></blockquote><blockquote type="cite">would move pdns back to port 53 and keep it connected to mysql for<br></blockquote><blockquote type="cite">lookups.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I would like it to be setup that recursor queries the pdns server and<br></blockquote><blockquote type="cite">database if we are authoritative for the domain. Otherwise recursor<br></blockquote><blockquote type="cite">should looks to the authoritative server for the answer.<br></blockquote><blockquote type="cite"><br></blockquote><br>If the pdns server is authoritive for the domain, every recursor in the<br>world will look at your pdns server when it want to ask about that<br>domain. Because the root and TLD will point them to your pdns server.<br><br>Thus so will your own recursor.<br><br>I suggest you set up a few domains in your recursor to point to your<br>pdns for the domains. The few domains you use internally (don't forget<br>your reverse DNS blocks).<br><br>Just in case you lose connectivity to the outside world and the external<br>root/TLD-servers can't be reached.<br><br><blockquote type="cite">Is there another resource that I can reference for this setup? I<br></blockquote><blockquote type="cite">believe I am just missing one or two pieces to get it working properly.<br></blockquote><blockquote type="cite"><br></blockquote><br>Well, I hope the above makes sense to you. Atleast if that is the setup<br>you want then it should not need any other configuration then what I<br>mentioned above.<br><br><blockquote type="cite">I appreciate the help!<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Thanks,<br></blockquote><blockquote type="cite">Patrick<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><br></span></blockquote></div><br></div></body></html>