<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I noticed I failed to reply to the list...<br>
<br>
<br>
-------- Original Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject: </th>
<td>Re: [Pdns-users] Recursion when Powerdns auth servers is
SOA</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th>
<td>Tue, 10 Jan 2012 14:56:13 -0800</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th>
<td>Rory Toma <a class="moz-txt-link-rfc2396E" href="mailto:rory@ooma.com"><rory@ooma.com></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th>
<td>bert hubert <a class="moz-txt-link-rfc2396E" href="mailto:bert.hubert@netherlabs.nl"><bert.hubert@netherlabs.nl></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
On 1/10/12 2:48 PM, bert hubert wrote:
<blockquote
cite="mid:13130C19-6172-414C-B442-C088B28693BC@netherlabs.nl"
type="cite"><br>
<div>
<div>On Jan 10, 2012, at 11:37 PM, Rory Toma wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<div bgcolor="#FFFFFF" text="#000000"><span
class="Apple-style-span" style="font-family: 'luxi sans',
sans-serif; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; line-height:
normal; orphans: 2; text-align: -webkit-auto; text-indent:
0px; text-transform: none; white-space: normal; widows: 2;
word-spacing: 0px; -webkit-text-decorations-in-effect:
none; -webkit-text-size-adjust: auto;
-webkit-text-stroke-width: 0px; font-size: medium; ">"To
make sure that the local authoritative database overrides
recursive information, PowerDNS first tries to answer a
question from its own database. If that succeeds, the
answer packet is sent back immediately without involving
the recursor in any way. This means that for questions for
which there is no answer, PowerDNS will consult the
recursor for an recursive query, even if PowerDNS is
authoritative for a domain! This will only cause problems
if you 'fake' domains which don't really exist.</span>"<br>
<br>
What I want to do is have powerdns consult the recursor even
of powerdns is authoritative for a domain. This is what I
can' seem to get to work.<br>
</div>
</blockquote>
<div><br>
</div>
<div>I think we no longer do this, and that the documentation is
in that case out of date. It complicated things too badly.</div>
<div><br>
</div>
<div>If you want to override the internet, you may have more
success the other way around, put a PowerDNS Recursor with
specific authoritative data as an auth server.</div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Bert</div>
</div>
</blockquote>
<br>
I'll explain my problem in a little more detail, and then perhaps
suggestions can flow:<br>
<br>
We are using dns as a registration system. Devices contact a server
and register, a dns record is created. For the sake of this
discussion, I'll refer to this as old registration system (bind and
old registration servers) and new registration system (powerdns and
new server)<br>
<br>
Many "apps" need to look up the information in dns, we have a
keepalived fault tolerant IP address that points to a name server
(currently bind), but we'd like to switch this to powerdns. However,
we can't just switch all the dns records over at once, there has to
be a transition period. So, we'd like to switch over to powerdns and
new registration server. All new records will exist in powerdns.
Eventually, all the old records will migrate as clients re-register.<br>
<br>
So, when someone queries the new server, it needs to look up the
data first in powerdns, and if it isn't there, recurse.<br>
<br>
I tried putting the powerdns recursor in front. It did not work for
me, as each backend server thinks it is authoritative. So if it
happens to query that one first, it returns NXDOMAIN and never looks
at the next one in the list.<br>
<br>
</body>
</html>