<div dir="ltr">I dont believe we have those configured currently..at least not any named way.. I do have:<br><br>pdns-recursor.service - PowerDNS Recursor<br> Loaded: loaded (/lib/systemd/system/pdns-recursor.service; enabled; vendor preset: enabled)<br> Active: active (running) since Wed 2022-08-24 15:19:00 EDT; 3s ago<br> Docs: man:pdns_recursor(1)<br> man:rec_control(1)<br> <a href="https://doc.powerdns.com">https://doc.powerdns.com</a><br> Main PID: 490386 (pdns_recursor)<br> Tasks: 5 (limit: 9437)<br> Memory: 10.1M<br> CGroup: /system.slice/pdns-recursor.service<br> └─490386 /usr/sbin/pdns_recursor --daemon=no --write-pid=no --disable-syslog --log-timestamp=no<br><br>Aug 24 15:19:00 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: Done priming cache with root hints<br>Aug 24 15:19:00 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: Done priming cache with root hints<br>Aug 24 15:19:00 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: Enabled 'epoll' multiplexer<br>Aug 24 15:19:01 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: stats: 187 questions, 1221 cache entries, 19 negative entries, 1% cache hits<br>Aug 24 15:19:01 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: stats: throttle map: 1, ns speeds: 677, failed ns: 0, ednsmap: 257<br>Aug 24 15:19:01 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: stats: outpacket/query ratio 250%, 0% throttled, 0 no-delegation drops<br>Aug 24 15:19:01 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: stats: 5 outgoing tcp connections, 18 queries running, 0 outgoing timeouts<br>Aug 24 15:19:01 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: stats: 151 packet cache entries, 6% packet cache hits<br>Aug 24 15:19:01 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: stats: thread 0 has been distributed 87 queries<br>Aug 24 15:19:01 <a href="http://cache1.holycross.edu">cache1.holycross.edu</a> pdns_recursor[490386]: stats: thread 1 has been distributed 98 queries<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 24, 2022 at 3:35 PM Otto Moerbeek <<a href="mailto:otto@drijf.net">otto@drijf.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Wed, Aug 24, 2022 at 03:27:15PM -0400, Holmes, Timothy wrote:<br>
<br>
> Thanks Otto, definitely is the correct config file, if for instance I<br>
> change the host-hints-file look up to no, the service fails to load and<br>
> indicates it cant find the file named no (assume we're not on that version<br>
> yet... separate issue.. )<br>
> <br>
> I conclude it's ignoring the forward zones recurse because at the<br>
> enterprise edge firewall the only dns lookups I see coming from the box (by<br>
> the vast volumes) and heading outside are heading to other name servers<br>
> than anything I specified. Looks like typical root hint type recursive<br>
> lookups. Not a single instance for the specified forwarder(s).<br>
> <br>
> I did confirm that dig's etc to 9.9.9.9 etc in CLI do allow just fine, so<br>
> there is no local firewall blockage.<br>
> <br>
> Any other thoughts? Seems odd, but I am new to PDNS..<br>
<br>
Please show the startup log.<br>
<br>
-Otto<br>
<br>
> <br>
> Best, Tim<br>
> <br>
> <br>
> <br>
> On Wed, Aug 24, 2022 at 3:13 PM Otto Moerbeek <<a href="mailto:otto@drijf.net" target="_blank">otto@drijf.net</a>> wrote:<br>
> <br>
> > On Wed, Aug 24, 2022 at 09:05:46PM +0200, Otto Moerbeek via Pdns-users<br>
> > wrote:<br>
> ><br>
> > > On Wed, Aug 24, 2022 at 02:09:11PM -0400, Holmes, Timothy via Pdns-users<br>
> > wrote:<br>
> > ><br>
> > > > Hi Team,<br>
> > > ><br>
> > > > I have what I hope is a simple question I'm unable to find a better<br>
> > answer<br>
> > > > for. I would like to add some external forwarders to our recursor<br>
> > > > instances. These are live running prod instances. I verified the live<br>
> > paths<br>
> > > > and updated the recursor.config's to reflect<br>
> > > ><br>
> > > > forward-zones-recurse=.=9.9.9.9;149.112.112.112;1.1.1.2;1.0.0.2<br>
> > > > and also tried forward-zones-recurse=.=9.9.9.9<br>
> > > ><br>
> > > > Each time pushed a restart and verified. Each time the root name hints<br>
> > seem<br>
> > > > to still be the default behavior including after removing the<br>
> > referenced<br>
> > > > root hint file entry.<br>
> > > ><br>
> > > > sudo service pdns-recursor restart<br>
> > > > sudo service pdns-recursor status<br>
> > > ><br>
> > > > Am I missing something obvious, or will the root hints always take<br>
> > > > precedence?<br>
> > > ><br>
> > > > Thanks, Tim<br>
> > > > --<br>
> > > ><br>
> > > > [image: College of the Holy Cross Logo]<br>
> > > ><br>
> > > > *TIM HOLMES*<br>
> > > > *Chief Information Security Officer*<br>
> > > > Information Technology Services<br>
> > > > <a href="mailto:tholmes@holycross.edu" target="_blank">tholmes@holycross.edu</a><br>
> > > > Pronouns: He/Him/His<br>
> > ><br>
> > > Syntax loogs good. Checks the log, when starting up the recusor logs<br>
> > > the redirects configged. If it does not do that, you are using another<br>
> > > config file than you are editing. Maybe an alternate --config-dir?<br>
> ><br>
> > Also, how do you conclude it is ingnoring the forward-zones-recurse?<br>
> ><br>
> > -Otto<br>
> ><br>
</blockquote></div>