<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<div class=""><br class=""></div><div class="">Could you share the configuration of the PDNS Auth server please?</div><div class=""><br class=""></div><div class="">Frank Louwers</div><div class="">Certified PowerDNS Consultant @ <a href="http://Kiwazo.be" class="">Kiwazo.be</a><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 19 Jan 2021, at 10:08, Dedan Irungu via Pdns-users <<a href="mailto:pdns-users@mailman.powerdns.com" class="">pdns-users@mailman.powerdns.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">I have made the changes request as soon below. The server does not serve authoritative results.<div class=""><br class=""></div><div class=""> setLocal('85.10.203.183')<br class=""> setACL({'<a href="http://0.0.0.0/0" class="">0.0.0.0/0</a>', '::/0'}) -- Allow all IPs access<br class=""><br class=""> newServer({address='<a href="http://85.10.203.183:5300/" class="">85.10.203.183:5300</a>', pool='auth'})<br class=""> newServer({address='<a href="http://85.10.203.183:5301/" class="">85.10.203.183:5301</a>', pool='recursor'})<br class=""><br class=""> recursive_ips = newNMG()<br class=""> recursive_ips:addMask('<a href="http://127.0.0.1/8" class="">127.0.0.1/8</a>') -- These network masks are the ones from allow-recursion in the Authoritative Server</div><div class=""><br class=""> addAction(NetmaskGroupRule(recursive_ips), PoolAction('recursor'))<br class=""> addAction(AllRule(), PoolAction('auth'))<br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I have tried to target powerdns directly via port 5300 but the result is the same. Any dig performed on port 5300 should be authoritative but in this case it is not.</div><div class=""><br class=""></div><div class="">dig @<a href="http://85.10.203.183/" class="">85.10.203.183</a> <a href="http://gifsitebuilder.com/" class="">gifsitebuilder.com</a> A -p 5300<br class=""></div><div class=""><br class=""><div class=""><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><br class=""><div class=""><br class=""></div></div></div></div></div></div></div></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 19, 2021 at 11:51 AM Brian Candler <<a href="mailto:b.candler@pobox.com" class="">b.candler@pobox.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class="">
<div class="">On 19/01/2021 08:40, Dedan Irungu via
Pdns-users wrote:<br class="">
</div>
<blockquote type="cite" class="">
recursive_ips:addMask('<a href="http://0.0.0.0/0" target="_blank" class="">0.0.0.0/0</a>') -- These network masks
are the ones from allow-recursion in the Authoritative Server<br class="">
<br class="">
addAction(NetmaskGroupRule(recursive_ips),
PoolAction('recursor'))<br class="">
</blockquote><p class="">These two lines together say: "for incoming queries from *any* IP
addresses: send them to the recursor".<br class="">
</p><p class="">Try changing the first one to something like:</p><p class=""> recursive_ips:addMask('<a href="http://0.0.0.0/0" target="_blank" class="">192.168.0.0/16</a>')
-- netblock containing your local clients<br class="">
</p><p class="">Then queries from 192.168.x.x will go to the recursor, whereas
queries from any *other* addresses will go to the authoritative
server.<br class="">
</p>
</div>
</blockquote></div>
_______________________________________________<br class="">Pdns-users mailing list<br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" class="">Pdns-users@mailman.powerdns.com</a><br class=""><a href="https://mailman.powerdns.com/mailman/listinfo/pdns-users" class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a><br class=""></div></blockquote></div><br class=""></div><div class=""><div class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: "Avenir Next"; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Frank Louwers<br class="">PowerDNS Certified Consultant @ <a href="http://Kiwazo.be" class="">Kiwazo.be</a><br class=""><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: "Avenir Next"; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""></div><br class="Apple-interchange-newline"></div></div><br class="Apple-interchange-newline"></div></div></body></html>