<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 23/07/2017 08:23, Rune Sørensen
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CADYwUhP6ezsNAZtwQmzipEN-qb2HmKLyhDBK+etrB9kjdUZQCg@mail.gmail.com">It
might be a strange setup, but we are trying to have a PowerDNS
server that acts as the authoritative name server for <a
href="http://flcn.io" target="_blank" moz-do-not-send="true">flcn.io</a>
for clients on our network, while Cloudflare DNS acts as the
authoritative DNS for everyone else.</blockquote>
<p>The recommended way to do this with powerdns is:<br>
</p>
<p>1. Run an instance (or two) of pdns-recursor on your local
network. Point your clients at it.</p>
<p>2. Run a separate instance (or two) of pdns-server, authoritative
for flcn.io</p>
<p>3. On your pdns-recursor, configure:</p>
<p># /etc/powerdns/recursor.conf<br>
forward-zones-file=/etc/powerdns/forward-zones</p>
<p># /etc/powerdns/forward-zones<br>
flcn.io=x.x.x.x # or x.x.x.x, x.x.x.y</p>
<p>Your instance of pdns-server can be on the same physical box as
pdns-recursor but listening on a different port, e.g. 5300. In
that case:</p>
<p># /etc/powerdns/forward-zones<br>
flcn.io=127.0.0.1:5300</p>
This approach is useful if you want to have reverse DNS for private
addresses:<br>
<br>
10.in-addr.arpa=127.0.0.1:5300<br>
168.192.in-addr.arpa=127.0.0.1:5300<br>
<br>
However in general, I find split DNS like this to be more trouble
than it's worth. Eventually you'll have hard-to-diagnose problems
where everything looks OK for your internal users but your external
users have a problem (or vice versa), due to the zones not being in
sync. To avoid this I would put all private addresses into a
separate sub-domain, e.g. "int.flcn.io", which is not delegated on
the Internet.<br>
<br>
It's also worth knowing something about pdns-recursor: it is
optimised for very high query rates in an ISP environment. To
achieve this it has a separate "packet cache", so that if it sees
the exact same query packet, it answers the same way as before.<br>
<br>
What this means is that if client A and client B send slightly
different packets (e.g. with different DNS options, such as from
different versions of "dig"), A and B are answered from two
different cache entries. In the time where a record has changed,
and one cache entry has expired but the other has not, this can mean
A and B see different replies. If this bothers you, you can turn
off the packet cache.<br>
<a class="moz-txt-link-freetext" href="https://doc.powerdns.com/md/recursor/settings/#disable-packetcache">https://doc.powerdns.com/md/recursor/settings/#disable-packetcache</a><br>
<br>
Cheers,<br>
<br>
Brian.<br>
</body>
</html>