<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 18/01/2022 14:38, <a class="moz-txt-link-abbreviated" href="mailto:jrd-pdns@jrd.org">jrd-pdns@jrd.org</a>
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:25062.53486.767637.12094@gargle.gargle.HOWL">
<pre class="moz-quote-pre" wrap="">. . . but when I query direct to the pdns, it also doesn't say it's
authoritative. See previous mail.</pre>
</blockquote>
<p>Sorry, I missed that mail. Did you send a dig directly to port
5300? I didn't catch that.<br>
</p>
<p>
</p>
<blockquote type="cite"
cite="mid:25062.53486.767637.12094@gargle.gargle.HOWL">
<pre class="moz-quote-pre" wrap="">I probably need to go back and re-read the DNS specs. It's been years
since I was deep into this, but I don't remember that a recursor
always returns non-authoritative, even when wherever it got the answer
was authoritative. Did that behaviour change somewhere along in
there?
</pre>
</blockquote>
<p>I don't think it's changed, although bind may have performed in
an odd way (e.g. returning AA for the first answer from cache,
non-AA for subsequent)</p>
<p>Even from the very oldest spec, RFC1035:<br>
</p>
<pre class="newpage" style="font-size: 13.3333px; margin-top: 0px; margin-bottom: 0px; break-before: page; color: rgb(0, 0, 0); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">AA Authoritative Answer - this bit is valid in responses,
and specifies that <b>the responding name server is an
authority for the domain name in question section</b>.</pre>
<p>A recursor is not an authority for the name.<br>
</p>
<blockquote type="cite"
cite="mid:25062.53486.767637.12094@gargle.gargle.HOWL">
<pre class="moz-quote-pre" wrap="">
Assuming I'm simply mis-remembering how that's supposed to work,
what's the recipe for setting up a local (set of) server(s) which:
. Returns authoritative for some zones, for which it has local data
. Recurses to other servers for other zones</pre>
</blockquote>
<p>You Really Don't Want To Do That™.</p>
<p>If you think you must (and continue to use powerdns), then you
can look at putting dnsdist in front of pdns-auth and
pdns-recursor. But really, really you don't. Just give your
cache(s) their own IP addresses, and your authoritative server(s)
their own IP addresses. This is how DNS is supposed to work.</p>
<p>The only reason I can think of for not doing that is that you
need to share a single public IP address between recursor and
authoritative; but then you might as well just put your recursor
behind NAT. Either way, it doesn't scale, and pdns is designed
for ISP-scale deployments.<br>
</p>
</body>
</html>