[Pdns-users] Recursor and subdomain forward

[Brian Candler]

Works for me, with 4.3.0-1pdns.bionic

Added to recursor.conf:
forward-zones=domain.sec=127.0.0.1:5300

Restarted pdns-recursor

Test:

root at cache1:~# dig @localhost testing.domain.sec a

; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> @localhost testing.domain.sec a
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54252
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

In another window, while doing the above:

root at cache1:~# tcpdump -i lo -nnX port 5300
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
16:40:24.603111 IP 127.0.0.1.26305 > 127.0.0.1.5300: UDP, length 47
     0x0000:  4500 004b c7dc 4000 4011 74c3 7f00 0001 E..K.. at .@.t.....
     0x0010:  7f00 0001 66c1 14b4 0037 fe4a 740e 0000 ....f....7.Jt...
     0x0020:  0001 0000 0000 0001 0774 6573 7469 6e67 .........testing
     0x0030:  0664 6f6d 6169 6e03 7365 6300 0001 0001 .domain.sec.....
     0x0040:  0000 2904 d000 0080 0000 00 ..)........

So I'm sorry, I don't know what's different about your setup. You did 
restart pdns-recursor? Does "journalctl -eu pdns-recursor" show any 
errors or warnings at startup?