[Pdns-users] Recursive Forwarders

[Holmes, Timothy]

I dont believe we have those configured currently..at least not any named
way..  I do have:

pdns-recursor.service - PowerDNS Recursor
     Loaded: loaded (/lib/systemd/system/pdns-recursor.service; enabled;
vendor preset: enabled)
     Active: active (running) since Wed 2022-08-24 15:19:00 EDT; 3s ago
       Docs: man:pdns_recursor(1)
             man:rec_control(1)
             https://doc.powerdns.com
   Main PID: 490386 (pdns_recursor)
      Tasks: 5 (limit: 9437)
     Memory: 10.1M
     CGroup: /system.slice/pdns-recursor.service
             └─490386 /usr/sbin/pdns_recursor --daemon=no --write-pid=no
--disable-syslog --log-timestamp=no

Aug 24 15:19:00 cache1.holycross.edu pdns_recursor[490386]: Done priming
cache with root hints
Aug 24 15:19:00 cache1.holycross.edu pdns_recursor[490386]: Done priming
cache with root hints
Aug 24 15:19:00 cache1.holycross.edu pdns_recursor[490386]: Enabled 'epoll'
multiplexer
Aug 24 15:19:01 cache1.holycross.edu pdns_recursor[490386]: stats: 187
questions, 1221 cache entries, 19 negative entries, 1% cache hits
Aug 24 15:19:01 cache1.holycross.edu pdns_recursor[490386]: stats: throttle
map: 1, ns speeds: 677, failed ns: 0, ednsmap: 257
Aug 24 15:19:01 cache1.holycross.edu pdns_recursor[490386]: stats:
outpacket/query ratio 250%, 0% throttled, 0 no-delegation drops
Aug 24 15:19:01 cache1.holycross.edu pdns_recursor[490386]: stats: 5
outgoing tcp connections, 18 queries running, 0 outgoing timeouts
Aug 24 15:19:01 cache1.holycross.edu pdns_recursor[490386]: stats: 151
packet cache entries, 6% packet cache hits
Aug 24 15:19:01 cache1.holycross.edu pdns_recursor[490386]: stats: thread 0
has been distributed 87 queries
Aug 24 15:19:01 cache1.holycross.edu pdns_recursor[490386]: stats: thread 1
has been distributed 98 queries

On Wed, Aug 24, 2022 at 3:35 PM Otto Moerbeek <otto at drijf.net> wrote:

> On Wed, Aug 24, 2022 at 03:27:15PM -0400, Holmes, Timothy wrote:
>
> > Thanks Otto, definitely is the correct config file, if for instance I
> > change the host-hints-file look up to no, the service fails to load and
> > indicates it cant find the file named no (assume we're not on that
> version
> > yet... separate issue.. )
> >
> > I conclude it's ignoring the forward zones recurse because at the
> > enterprise edge firewall the only dns lookups I see coming from the box
> (by
> > the vast volumes) and heading outside are heading to other name servers
> > than anything I specified. Looks like typical root hint type recursive
> > lookups. Not a single instance for the specified forwarder(s).
> >
> > I did confirm that dig's etc to 9.9.9.9 etc in CLI do allow just fine, so
> > there is no local firewall blockage.
> >
> > Any other thoughts? Seems odd, but I am new to PDNS..
>
> Please show the startup log.
>
>         -Otto
>
> >
> > Best, Tim
> >
> >
> >
> > On Wed, Aug 24, 2022 at 3:13 PM Otto Moerbeek <otto at drijf.net> wrote:
> >
> > > On Wed, Aug 24, 2022 at 09:05:46PM +0200, Otto Moerbeek via Pdns-users
> > > wrote:
> > >
> > > > On Wed, Aug 24, 2022 at 02:09:11PM -0400, Holmes, Timothy via
> Pdns-users
> > > wrote:
> > > >
> > > > > Hi Team,
> > > > >
> > > > > I have what I hope is a simple question I'm unable to find a better
> > > answer
> > > > > for. I would like to add some external forwarders to our recursor
> > > > > instances. These are live running prod instances. I verified the
> live
> > > paths
> > > > > and updated the recursor.config's to reflect
> > > > >
> > > > > forward-zones-recurse=.=9.9.9.9;149.112.112.112;1.1.1.2;1.0.0.2
> > > > > and also tried forward-zones-recurse=.=9.9.9.9
> > > > >
> > > > > Each time pushed a restart and verified. Each time the root name
> hints
> > > seem
> > > > > to still be the default behavior including after removing the
> > > referenced
> > > > > root hint file entry.
> > > > >
> > > > > sudo service pdns-recursor restart
> > > > > sudo service pdns-recursor status
> > > > >
> > > > > Am I missing something obvious, or will the root hints always take
> > > > > precedence?
> > > > >
> > > > > Thanks, Tim
> > > > > --
> > > > >
> > > > > [image: College of the Holy Cross Logo]
> > > > >
> > > > > *TIM HOLMES*
> > > > > *Chief Information Security Officer*
> > > > > Information Technology Services
> > > > > tholmes at holycross.edu
> > > > > Pronouns: He/Him/His
> > > >
> > > > Syntax loogs good. Checks the log, when starting up the recusor logs
> > > > the redirects configged. If it does not do that, you are using
> another
> > > > config file than you are editing. Maybe an alternate --config-dir?
> > >
> > > Also, how do you conclude it is ingnoring the forward-zones-recurse?
> > >
> > >         -Otto
> > >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.powerdns.com/pipermail/pdns-users/attachments/20220824/6abb57b4/attachment-0001.htm>