<div dir="ltr"><div>I set the forward-zones-recurse option and it seems to be working correctly. It makes me question if the understanding of the query flow is just all wrong. I will pursue separating authoritative and recursive since this isn't working as expected. I guess I'm curious why the recursor options are even present if this functionality doesnt work for any zones that are authoritative. All other recursion is working with exception to zones we're authoritative of that need additional recursion. I'll review the materials you suggested to get some more insight though it seems to stand that some additional clarification might be necessary for the pdns documentation :) <br></div><div><br></div><div>I appreciate the help. Thank you.</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Feb 4, 2015 at 8:57 AM, Stefan Schmidt <span dir="ltr"><<a href="mailto:zaphodb@zaphods.net" target="_blank">zaphodb@zaphods.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 2015-02-04 14:00, James Cornman wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[james@eng:~] % dig @<a href="http://10.250.50.237" target="_blank">10.250.50.237</a> [2] 100.94.145.204.in-addr.arpa<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
ptr<br>
<br>
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.<u></u>el5_4.2 <<>> @<a href="http://10.250.50.237" target="_blank">10.250.50.237</a><br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0<br>
<br>
;; QUESTION SECTION:<br>
;100.94.145.204.in-addr.arpa. IN PTR<br>
<br>
;; AUTHORITY SECTION:<br>
100.94.145.204.in-addr.arpa. 3600 IN NS<br>
<a href="http://ns17.bitronictech.net" target="_blank">ns17.bitronictech.net</a>.<br>
<br>
</blockquote>
<br>
</blockquote>
It indeed returns with the authoritative answer, but I believe my<br>
expectation was that since recursion is desired, and there is a<br>
pdns-recursor available, that it would do the deed. Mainly that dig or<br>
nslookup off of the pdns-authoritative server, with recursion enabled,<br>
would end up with an actual PTR answer. You mention that BIND just happens<br>
to do both at the same time..is that something that PDNS can't do, or<br>
something I'm doing wrong, or in general a false perception of what is<br>
right?<br>
</blockquote>
<br></span>
For recursion to become available on the authoritative Server (i.e. pdns-server) the config variables<br>
<a href="https://doc.powerdns.com/md/authoritative/settings/#recursor" target="_blank">https://doc.powerdns.com/md/<u></u>authoritative/settings/#<u></u>recursor</a><br>
and<br>
<a href="https://doc.powerdns.com/md/authoritative/settings/#allow-recursion" target="_blank">https://doc.powerdns.com/md/<u></u>authoritative/settings/#allow-<u></u>recursion</a><br>
will have to be set accordingly.<br>
However it is discouraged to do recursion with the auth Server because it leads to exactly the kind of confusion you ran into.<br>
Also <a href="http://cr.yp.to/djbdns/separation.html" target="_blank">http://cr.yp.to/djbdns/<u></u>separation.html</a> lists some good reasons for keeping those two services separated from each other.<br>
BIND9 also changed its default behaviour in that regard. ( <a href="https://kb.isc.org/article/AA-00269/0/What-has-changed-in-the-behavior-of-allow-recursion-and-allow-query-cache.html" target="_blank">https://kb.isc.org/article/AA-<u></u>00269/0/What-has-changed-in-<u></u>the-behavior-of-allow-<u></u>recursion-and-allow-query-<u></u>cache.html</a> )<span class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Here you ask with the "rd" aka recursion desired flag and it appears that<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
your BIND Server is indeed configured to recurse for you and go ask<br>
<a href="http://ns17.bitronictech.net" target="_blank">ns17.bitronictech.net</a> about the PTR for 100.94.145.204.in-addr.arpa. This<br>
is now recursive DNS works, however it is not how authoritative DNS works.<br>
BIND just happens to do both at the same time.<br>
<br>
</blockquote>
Querying the pdns-recursor directly does return the proper result, however<br>
ARIN isn't set to point to this pool of pdns servers and thus this<br>
recursion is likely interacting with BIND which is still authoritative for<br>
the reverse in-addr.arpa zone....none of which helps my troubleshooting<br>
</blockquote>
<br></span>
Correct, if the ARIN nameservers are still pointing to the IPs of your BIND9 setup then there is no easy way to test if your new setup works with recursive nameservers.<br>
As i said already you could tell your recursive Server to ask the IP of your PowerDNS auth setup directly, thus bypassing the ARIN delegation.<br>
In PowerDNS recursor you could do that with the <a href="https://doc.powerdns.com/md/recursor/settings/#forward-zones-recurse" target="_blank">https://doc.powerdns.com/md/<u></u>recursor/settings/#forward-<u></u>zones-recurse</a> option.<br>
For example put<br>
forward-zones-recurse=94.145.<u></u>204.in-addr.arpa=10.250.50.237<br>
in your recursor.conf.<span class="HOEnZb"><font color="#888888"><br>
<br>
Stefan<br>
<br>
</font></span></blockquote></div><br></div>