<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 09/07/2021 14:43, informant--- via
Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:3089114269d12189b68539695e012e91@trinaxab.se"><span
style="font-size:12px;"><span
style="font-family:Tahoma,Geneva,sans-serif;">I intend to set
up a PowerDNS authoritative server and recursor, where a few
subdomains will be forwarded to the auth server for internal
use only. (local IP addresses) We do not wish to allow lookups
for these domains by any external host. So far, so good.</span></span><br>
<br>
<span style="font-size:12px;"><span
style="font-family:Tahoma,Geneva,sans-serif;">Now,
additionally, I would like to employ Let’s Encrypt
certificates for these private services by using DNS wildcard
challenge. This, of course, requires that the DNS server be
public. My question, then, is can I set up PowerDNS in such a
way that the DNS server allows the necessary lookups required
to complete the DNS challenge, but prevents lookups for any
subdomains by any external host?</span></span></blockquote>
<p>You have a domain like "int.example.com" where you don't want any
names to be visible to the outside world, but you want to be able
to obtain certificates for them. Correct?<br>
</p>
<p>The way I deal with this is to have a separate nameserver, say
ns-acme.example.com, and delegate int.example.com to that server
(in the public DNS):</p>
<p>int.example.com. NS ns-acme.example.com.</p>
<p>The zone file on ns-acme is empty, so if anyone tries to resolve
XXX.int.example.com they'll get NXDOMAIN. However, you also set
up TSIG zones on this server so that servers can response to DNS01
challenges.</p>
<p>You can either just have a single TSIG record which allows all
updates to the domain; or (more securely) you can create separate
zones on the nameserver, e.g.</p>
<p>_acme-challenge.foo.int.example.com<br>
_acme-challenge.bar.int.example.com</p>
<p>so that the servers foo.int.example.com and bar.int.example.com
have separate TSIG keys, and can only issue certs for themselves.</p>
<p>Any lightweight authoritative DNS server that supports TSIG
updates is fine - e.g. powerdns with SQLite backend, BIND with
filebackend.<br>
</p>
<p>Regards,</p>
<p>Brian.<br>
</p>
</body>
</html>