<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">I’m hoping I can get some behavior questions clarified regarding how PowerDNS recursor handles EDNS client-subnet requests/responses. We’re looking at sending ECS to Akamai, and they have very specific requirements for how the resolver
behaves.<br>
<br>
First, if the client sends a request to pdns-recursor that includes ECS data, they want to be assured that the client subnet sent to Akamai’s authoritative server is the actual client IP/subnet as seen by pdns and not the IP/subnet from the client’s ECS data.
I think that “use-incoming-edns-subnet” defaulting to “no” covers this case, but wanted to verify that having dnsdist in front of pdns-recursor, using the proxy protocol to pass requests, did not cause pdns-recursor to honor the forwarded ECS data.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The second question is regarding how the response is formulated. Akamai wants to be assured that the scope and mask in Akamai’s response is not passed back to the end user. I did not see a clear answer one way or the other in the pdns
documentation, so I wanted to verify that this is what pdns-recursor does.<br>
<br>
If there are specific options to pdns-recursor and/or dnsdist that are needed to achieve this behavior, that would be appreciated as well.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Mark<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-- <o:p></o:p></p>
<p class="MsoNormal">XML combines the efficiency of text files with the readability of binary files<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>