<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Dear Yves,<div class=""><br class=""></div><div class="">It might be best to describe your setup in a bit more detail:</div><div class=""><br class=""></div><div class="">- what client devices use your resolver, are they all on internal IT infra? (Your home of office net?) How many devices are we talking about? How do they configure the ip of their resolver? (Hand-set, dhcp, ...)?</div><div class=""><br class=""></div><div class="">- what type of domains do you have hosted on the auth server? How many of them, does the domain names (the domainname, not the zone-content) ever change? Do they all have a common tld? (eg: mail.home, files.home, printers.mycompany, ...)?</div><div class=""><br class=""></div><div class="">- Do those domain names have NS delegations in the current ICANN-run, dns-world as we know it today? If not, is anything preventing that?</div><div class=""><br class=""></div><div class="">The answers to those questions are needed to give you the advise you need, as I am sure their will be a solution to your problem.</div><div class=""><br class=""></div><div class="">Kind Regards,</div><div class=""><br class=""></div><div class="">Frank</div><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 23 Jun 2020, at 20:47, Yves Goergen via Pdns-users <<a href="mailto:pdns-users@mailman.powerdns.com" class="">pdns-users@mailman.powerdns.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Okay, so I'll have to repeat all the domains from the auth server's database in a static config file? What's the use of the database then?<br class=""><br class="">And then I still have two DNS servers: one that can resolve any public name, and another one that can resolve the names I host myself. The recursor is only accessible locally and the auth server is public. What should I use for the system's default DNS server? If I choose the first, I cannot resolve my own names locally. If I choose the second, only my own names work and the rest of the internet is unresolvable.<br class=""><br class="">PowerDNS auth server on port 53 and recursor internally forwarded to port 5300 worked fine with a single public IP address and port for queries from local and remote.<br class=""><br class="">-Yves<br class=""><br class=""><br class="">-------- Ursprüngliche Nachricht --------<br class="">Von: Brian Candler <<a href="mailto:b.candler@pobox.com" class="">b.candler@pobox.com</a>><br class="">Gesendet: Dienstag, 23. Juni 2020, 20:25 MESZ<br class="">Betreff: [Pdns-users] Running auth server and recursor on the same server, upgrading from 4.0.9<br class=""><br class="">On 23/06/2020 19:07, Yves Goergen via Pdns-users wrote:<br class="">I have only one server and one IPv4 address, so using a multi-IP setup<br class="">just isn't possible. With the decreased availability of IPv4<br class="">addresses, this isn't realistic either.<br class=""><br class="">It's not a problem: your recursor can be behind NAT on a private IP<br class="">address. Only your auth server needs to be accessible from the Internet<br class="">- and even then, only if you want your domains to be resolvable<br class="">externally (in which case, please also read RFC2182 and set up at least<br class="">one secondary on a remote network)<br class=""><br class=""><br class="">So how is this supposed to work? Can I still use PowerDNS or will I<br class="">have to find another solution that has the same features as PowerDNS<br class="">4.0.9?<br class=""><br class="">dnsdist is overkill here. For a small home network:<br class=""><br class="">- stick your recursor(s) on a private IP<br class=""><br class="">- stick your authoritative on a public IP (if required to be reachable<br class="">from outside)<br class=""><br class="">- on your recursor, configure any private non-delegated domains, i.e.<br class="">those without NS records in the public DNS, to forward those queries to<br class="">the authoritative server.<br class=""><br class="">For example:<br class=""><br class="">forward-zones-file=/etc/powerdns/forward.zones<br class=""><br class="">and in that file you could put:<br class=""><br class=""><a href="http://int.example.com" class="">int.example.com</a>=192.168.1.53<br class="">168.192.in-addr.arpa=192.168.1.53<br class="">10.in-addr.arpa=192.168.1.53<br class="">+.=9.9.9.9<br class=""><br class="">The last line is optional: it says to forward all other queries upstream<br class="">to 9.9.9.9 and to request recursion. This is if you want to use an<br class="">upstream filtered DNS service. Remove it and your recursor will follow<br class="">the DNS delegation tree as normal.<br class=""><br class="">If you don't like this, you might want to use a different DNS server.<br class="">PowerDNS is designed for large ISP-scale applications where separation<br class="">of recursor and authoritative roles is an absolute must.<br class=""><br class="">HTH,<br class=""><br class="">Brian.<br class=""><br class=""><br class=""><br class="">_______________________________________________<br class="">Pdns-users mailing list<br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" class="">Pdns-users@mailman.powerdns.com</a><br class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users<br class=""></div></div></blockquote></div><br class=""></div></body></html>