<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 04/04/2022 23:57, Brian Lehnhardt
via Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAE2d--k1Pm3F=MfHg+zahCV0_J6UREy3ouVQzkWdLcDFjp3NNw@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div class="gmail-s-prose gmail-js-post-body">
<p>It seems like this should just work, but perhaps I am
missing something. I'm using an older version of pdns as you
can see from my config, and I can't seem to find any
documentation on this older version. Any idea what I'm doing
wrong here?</p>
</div>
</div>
</blockquote>
<p>Indeed you are using a very old, unsupported version:</p>
<p><a class="moz-txt-link-freetext" href="https://doc.powerdns.com/authoritative/appendices/EOL.html">https://doc.powerdns.com/authoritative/appendices/EOL.html</a><br>
<a class="moz-txt-link-freetext" href="https://doc.powerdns.com/recursor/appendices/EOL.html">https://doc.powerdns.com/recursor/appendices/EOL.html</a><br>
</p>
<p>When you do migrate to supported versions, note that
authoritative and recursor have now been fully split: the
authoritative server since 4.1.0 cannot do any recursion at all
(*). There are some migration options in this article:</p>
<p><a class="moz-txt-link-freetext" href="https://doc.powerdns.com/authoritative/guides/recursion.html">https://doc.powerdns.com/authoritative/guides/recursion.html</a><br>
</p>
<p>If you really, really need a single IP address to respond to both
authoritative and recursive queries, then it's possible to put
dnsdist in front of them both. However I would suggest that you
split them properly:</p>
<p>- bind pdns-recursor to one IP address<br>
- bind pdns-auth to another IP address (or put it in its own VM or
container)</p>
<p>You then configure your end clients to point to the recursor, and
your NS records point to the authoritative server.<br>
</p>
<p>You can still forward queries from pdns-recursor to pdns-auth,
e.g. for private zones. Depending on whether the parent domain
has DNSSEC enabled, you may need to set a Negative Trust Anchor
for the subdomain.</p>
<p>So to do what you're want with modern powerdns, you need to swap
the roles around: clients must send their queries to the recursor,
not the authoritative server. Hence you could bind the recursor
to port 53, and auth to 5353 - as long as no external queries
arrive at the auth server (i.e. it's completely private, no NS
records point at it).<br>
</p>
<p>Regards,</p>
<p>Brian.<br>
</p>
<p>(*) pdns-auth can still make use of a <a moz-do-not-send="true"
href="https://doc.powerdns.com/authoritative/settings.html#resolver">resolver</a>
but this is only for when it needs to resolve things for itself,
like ALIAS records.<br>
</p>
</body>
</html>