[Pdns-users] How to make Authoritative work?

Tue Jan 18 12:19:59 UTC 2022

Incoming data dump:
---------------------------
# Autogenerated configuration file template

#################################
# ignore-unknown-settings	Configuration settings to ignore if they are unknown
#
# ignore-unknown-settings=

#################################
# 8bit-dns	Allow 8bit dns queries
#
# 8bit-dns=no

#################################
# allow-axfr-ips	Allow zonetransfers only to these subnets
#
# allow-axfr-ips=127.0.0.0/8,::1

#################################
# allow-dnsupdate-from	A global setting to allow DNS updates from these IP ranges.
#
# allow-dnsupdate-from=127.0.0.0/8,::1

#################################
# allow-notify-from	Allow AXFR NOTIFY from these IP ranges. If empty, drop all incoming notifies.
#
# allow-notify-from=0.0.0.0/0,::/0
allow-notify-from=

#################################
# allow-unsigned-autoprimary	Allow autoprimaries to create zones without TSIG signed NOTIFY
#
# allow-unsigned-autoprimary=yes

#################################
# allow-unsigned-notify	Allow unsigned notifications for TSIG secured zones
#
# allow-unsigned-notify=yes

#################################
# allow-unsigned-supermaster	Allow supermasters to create zones without TSIG signed NOTIFY
#
# allow-unsigned-supermaster=yes

#################################
# also-notify	When notifying a zone, also notify these nameservers
#
# also-notify=

#################################
# any-to-tcp	Answer ANY queries with tc=1, shunting to TCP
#
# any-to-tcp=yes
any-to-tcp=yes

#################################
# api	Enable/disable the REST API (including HTTP listener)
#
# api=no

#################################
# api-key	Static pre-shared authentication key for access to the REST API
#
# api-key=

#################################
# autosecondary	Act as an autosecondary (formerly superslave)
#
# autosecondary=no

#################################
# axfr-fetch-timeout	Maximum time in seconds for inbound AXFR to start or be idle after starting
#
# axfr-fetch-timeout=10

#################################
# axfr-lower-serial	Also AXFR a zone from a master with a lower serial
#
# axfr-lower-serial=no

#################################
# cache-ttl	Seconds to store packets in the PacketCache
#
# cache-ttl=20

#################################
# carbon-instance	If set overwrites the the instance name default
#
# carbon-instance=auth

#################################
# carbon-interval	Number of seconds between carbon (graphite) updates
#
# carbon-interval=30

#################################
# carbon-namespace	If set overwrites the first part of the carbon string
#
# carbon-namespace=pdns

#################################
# carbon-ourname	If set, overrides our reported hostname for carbon stats
#
# carbon-ourname=

#################################
# carbon-server	If set, send metrics in carbon (graphite) format to this server IP address
#
# carbon-server=

#################################
# chroot	If set, chroot to this directory for more security
#
# chroot=

#################################
# config-dir	Location of configuration directory (pdns.conf)
#
# config-dir=/etc/powerdns

#################################
# config-name	Name of this virtual configuration - will rename the binary image
#
# config-name=

#################################
# consistent-backends	Assume individual domains are not divided over backends. Send only ANY lookup operations to the backend to reduce the number of lookups
#
# consistent-backends=no

#################################
# control-console	Debugging switch - don't use
#
# control-console=no

#################################
# daemon	Operate as a daemon
#
# daemon=no

#################################
# default-api-rectify	Default API-RECTIFY value for zones
#
# default-api-rectify=yes

#################################
# default-ksk-algorithm	Default KSK algorithm
#
# default-ksk-algorithm=ecdsa256

#################################
# default-ksk-size	Default KSK size (0 means default)
#
# default-ksk-size=0

#################################
# default-publish-cdnskey	Default value for PUBLISH-CDNSKEY
#
# default-publish-cdnskey=

#################################
# default-publish-cds	Default value for PUBLISH-CDS
#
# default-publish-cds=

#################################
# default-soa-content	Default SOA content
#
# default-soa-content=a.misconfigured.dns.server.invalid hostmaster.@ 0 10800 3600 604800 3600

#################################
# default-soa-edit	Default SOA-EDIT value
#
# default-soa-edit=

#################################
# default-soa-edit-signed	Default SOA-EDIT value for signed zones
#
# default-soa-edit-signed=

#################################
# default-ttl	Seconds a result is valid if not set otherwise
#
# default-ttl=3600

#################################
# default-zsk-algorithm	Default ZSK algorithm
#
# default-zsk-algorithm=

#################################
# default-zsk-size	Default ZSK size (0 means default)
#
# default-zsk-size=0

#################################
# direct-dnskey	Fetch DNSKEY, CDS and CDNSKEY RRs from backend during DNSKEY or CDS/CDNSKEY synthesis
#
# direct-dnskey=no

#################################
# disable-axfr	Disable zonetransfers but do allow TCP queries
#
# disable-axfr=no

#################################
# disable-axfr-rectify	Disable the rectify step during an outgoing AXFR. Only required for regression testing.
#
# disable-axfr-rectify=no

#################################
# disable-syslog	Disable logging to syslog, useful when running inside a supervisor that logs stdout
#
# disable-syslog=no

#################################
# disable-tcp	Do not listen to TCP queries
#
# disable-tcp=no

#################################
# distributor-threads	Default number of Distributor (backend) threads to start
#
# distributor-threads=3

#################################
# dname-processing	If we should support DNAME records
#
# dname-processing=no

#################################
# dnssec-key-cache-ttl	Seconds to cache DNSSEC keys from the database
#
# dnssec-key-cache-ttl=30

#################################
# dnsupdate	Enable/Disable DNS update (RFC2136) support. Default is no.
#
# dnsupdate=no

#################################
# domain-metadata-cache-ttl	Seconds to cache zone metadata from the database
#
# domain-metadata-cache-ttl=

#################################
# edns-subnet-processing	If we should act on EDNS Subnet options
#
# edns-subnet-processing=no

#################################
# entropy-source	If set, read entropy from this file
#
# entropy-source=/dev/urandom

#################################
# expand-alias	Expand ALIAS records
#
# expand-alias=no

#################################
# forward-dnsupdate	A global setting to allow DNS update packages that are for a Slave zone, to be forwarded to the master.
#
# forward-dnsupdate=yes

#################################
# forward-notify	IP addresses to forward received notifications to regardless of master or slave settings
#
# forward-notify=

#################################
# guardian	Run within a guardian process
#
# guardian=no

#################################
# include-dir	Include *.conf files from this directory
#
# include-dir=

#################################
# launch	Which backends to launch and order to query them in
#
# launch=
# -- jrd
# http://laurent.bachelier.name/2009/03/switching-from-bind-to-powerdns-in-a-few-seconds/
# launch=bind
# bind-config=/etc/bind/named.conf
# bind-check-interval=300
launch=gmysql
gmysql-host=localhost
gmysql-user=XXXXXXXX
gmysql-password=XXXXXXXX
gmysql-dbname=powerdns

#################################
# load-modules	Load this module - supply absolute or relative path
#
# load-modules=

#################################
# local-address	Local IP addresses to which we bind
#
# local-address=0.0.0.0, ::

#################################
# local-address-nonexist-fail	Fail to start if one or more of the local-address's do not exist on this server
#
# local-address-nonexist-fail=yes

#################################
# local-ipv6	DEPRECATED, will be removed, move your IPs to local-address
#
# local-ipv6=

#################################
# local-port	The port on which we listen
#
# local-port=53
local-port=5300

#################################
# log-dns-details	If PDNS should log DNS non-erroneous details
#
# log-dns-details=no
log-dns-details=yes

#################################
# log-dns-queries	If PDNS should log all incoming DNS queries
#
# log-dns-queries=no

#################################
# log-timestamp	Print timestamps in log lines
#
# log-timestamp=yes

#################################
# logging-facility	Log under a specific facility
#
# logging-facility=
logging-facility=4

#################################
# loglevel	Amount of logging. Higher is more. Do not set below 3
#
# loglevel=4
loglevel=7

#################################
# lua-axfr-script	Script to be used to edit incoming AXFRs
#
# lua-axfr-script=

#################################
# lua-dnsupdate-policy-script	Lua script with DNS update policy handler
#
# lua-dnsupdate-policy-script=

#################################
# lua-prequery-script	Lua script with prequery handler (DO NOT USE)
#
# lua-prequery-script=

#################################
# master	Act as a master
#
# master=no
master=yes

#################################
# max-cache-entries	Maximum number of entries in the query cache
#
# max-cache-entries=1000000

#################################
# max-ent-entries	Maximum number of empty non-terminals in a zone
#
# max-ent-entries=100000

#################################
# max-generate-steps	Maximum number of $GENERATE steps when loading a zone from a file
#
# max-generate-steps=0

#################################
# max-nsec3-iterations	Limit the number of NSEC3 hash iterations
#
# max-nsec3-iterations=100

#################################
# max-packet-cache-entries	Maximum number of entries in the packet cache
#
# max-packet-cache-entries=1000000

#################################
# max-queue-length	Maximum queuelength before considering situation lost
#
# max-queue-length=5000

#################################
# max-signature-cache-entries	Maximum number of signatures cache entries
#
# max-signature-cache-entries=

#################################
# max-tcp-connection-duration	Maximum time in seconds that a TCP DNS connection is allowed to stay open.
#
# max-tcp-connection-duration=0

#################################
# max-tcp-connections	Maximum number of TCP connections
#
# max-tcp-connections=20

#################################
# max-tcp-connections-per-client	Maximum number of simultaneous TCP connections per client
#
# max-tcp-connections-per-client=0

#################################
# max-tcp-transactions-per-conn	Maximum number of subsequent queries per TCP connection
#
# max-tcp-transactions-per-conn=0

#################################
# module-dir	Default directory for modules
#
# module-dir=/usr/lib64/powerdns/pdns

#################################
# negquery-cache-ttl	Seconds to store negative query results in the QueryCache
#
# negquery-cache-ttl=60

#################################
# no-shuffle	Set this to prevent random shuffling of answers - for regression testing
#
# no-shuffle=off

#################################
# non-local-bind	Enable binding to non-local addresses by using FREEBIND / BINDANY socket options
#
# non-local-bind=no

#################################
# only-notify	Only send AXFR NOTIFY to these IP addresses or netmasks
#
# only-notify=0.0.0.0/0,::/0
only-notify=

#################################
# out-of-zone-additional-processing	Do out of zone additional processing
#
# out-of-zone-additional-processing=yes

#################################
# outgoing-axfr-expand-alias	Expand ALIAS records during outgoing AXFR
#
# outgoing-axfr-expand-alias=no

#################################
# overload-queue-length	Maximum queuelength moving to packetcache only
#
# overload-queue-length=0

#################################
# prevent-self-notification	Don't send notifications to what we think is ourself
#
# prevent-self-notification=yes

#################################
# query-cache-ttl	Seconds to store query results in the QueryCache
#
# query-cache-ttl=20

#################################
# query-local-address	Source IP addresses for sending queries
#
# query-local-address=0.0.0.0 ::

#################################
# query-local-address6	DEPRECATED: Use query-local-address. Source IPv6 address for sending queries
#
# query-local-address6=

#################################
# query-logging	Hint backends that queries should be logged
#
# query-logging=no

#################################
# queue-limit	Maximum number of milliseconds to queue a query
#
# queue-limit=1500

#################################
# receiver-threads	Default number of receiver threads to start
#
# receiver-threads=1

#################################
# resolver	Use this resolver for ALIAS and the internal stub resolver
#
# resolver=no

#################################
# retrieval-threads	Number of AXFR-retrieval threads for slave operation
#
# retrieval-threads=2

#################################
# reuseport	Enable higher performance on compliant kernels by using SO_REUSEPORT allowing each receiver thread to open its own socket
#
# reuseport=no

#################################
# rng	Specify the random number generator to use. Valid values are auto,sodium,openssl,getrandom,arc4random,urandom.
#
# rng=auto

#################################
# security-poll-suffix	Domain name from which to query security update notifications
#
# security-poll-suffix=secpoll.powerdns.com.

#################################
# send-signed-notify	Send TSIG secured NOTIFY if TSIG key is configured for a domain
#
# send-signed-notify=yes

#################################
# server-id	Returned when queried for 'id.server' TXT or NSID, defaults to hostname - disabled or custom
#
# server-id=

#################################
# setgid	If set, change group id to this gid for more security
#
setgid=pdns

#################################
# setuid	If set, change user id to this uid for more security
#
setuid=pdns

#################################
# signing-threads	Default number of signer threads to start
#
# signing-threads=3

#################################
# slave	Act as a slave
#
# slave=no

#################################
# slave-cycle-interval	Schedule slave freshness checks once every .. seconds
#
# slave-cycle-interval=60

#################################
# slave-renotify	If we should send out notifications for slaved updates
#
# slave-renotify=no

#################################
# socket-dir	Where the controlsocket will live, /var/run/pdns when unset and not chrooted
#
# socket-dir=

#################################
# superslave	Act as a superslave
#
# superslave=no

#################################
# tcp-control-address	If set, PowerDNS can be controlled over TCP on this address
#
# tcp-control-address=

#################################
# tcp-control-port	If set, PowerDNS can be controlled over TCP on this address
#
# tcp-control-port=53000

#################################
# tcp-control-range	If set, remote control of PowerDNS is possible over these networks only
#
# tcp-control-range=127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fe80::/10

#################################
# tcp-control-secret	If set, PowerDNS can be controlled over TCP after passing this secret
#
# tcp-control-secret=

#################################
# tcp-fast-open	Enable TCP Fast Open support on the listening sockets, using the supplied numerical value as the queue size
#
# tcp-fast-open=0

#################################
# tcp-idle-timeout	Maximum time in seconds that a TCP DNS connection is allowed to stay open while being idle
#
# tcp-idle-timeout=5

#################################
# traceback-handler	Enable the traceback handler (Linux only)
#
# traceback-handler=yes

#################################
# trusted-notification-proxy	IP address of incoming notification proxy
#
# trusted-notification-proxy=

#################################
# udp-truncation-threshold	Maximum UDP response size before we truncate
#
# udp-truncation-threshold=1232

#################################
# upgrade-unknown-types	Transparently upgrade known TYPExxx records. Recommended to keep off, except for PowerDNS upgrades until data sources are cleaned up
#
# upgrade-unknown-types=no

#################################
# version-string	PowerDNS version in packets - full, anonymous, powerdns or custom
#
# version-string=full

#################################
# webserver	Start a webserver for monitoring (api=yes also enables the HTTP listener)
#
# webserver=no
webserver=yes

#################################
# webserver-address	IP Address of webserver/API to listen on
#
# webserver-address=127.0.0.1
webserver-address=0.0.0.0

#################################
# webserver-allow-from	Webserver/API access is only allowed from these subnets
#
# webserver-allow-from=127.0.0.1,::1

#################################
# webserver-loglevel	Amount of logging in the webserver (none, normal, detailed)
#
# webserver-loglevel=normal

#################################
# webserver-max-bodysize	Webserver/API maximum request/response body size in megabytes
#
# webserver-max-bodysize=2

#################################
# webserver-password	Password required for accessing the webserver
#
# webserver-password=

#################################
# webserver-port	Port of webserver/API to listen on
#
# webserver-port=8081

#################################
# webserver-print-arguments	If the webserver should print arguments
#
# webserver-print-arguments=no

#################################
# write-pid	Write a PID file
#
# write-pid=yes

#################################
# xfr-max-received-mbytes	Maximum number of megabytes received from an incoming XFR
#
# xfr-max-received-mbytes=100

------------------------
MariaDB [powerdns]> select * from domains where name = 'jrd.org';
+----+---------+--------+------------+--------+-----------------+---------+
| id | name    | master | last_check | type   | notified_serial | account |
+----+---------+--------+------------+--------+-----------------+---------+
|  5 | jrd.org |        |       NULL | MASTER |      2022010900 | NULL    |
+----+---------+--------+------------+--------+-----------------+---------+
1 row in set (0.000 sec)

MariaDB [powerdns]> select * from records where name = 'jrd.org';
+----+-----------+---------+------+-------------------------------------------------------------------------------+-------+------+----------+-----------+------+
| id | domain_id | name    | type | content                                                                       | ttl   | prio | disabled | ordername | auth |
+----+-----------+---------+------+-------------------------------------------------------------------------------+-------+------+----------+-----------+------+
| 19 |         5 | jrd.org | SOA  | f3-kong-dyndns.jrd.org postmaster.jrd.org 2022010900 10800 3600 3600000 86400 | 86400 |    0 |        0 | NULL      | NULL |
| 20 |         5 | jrd.org | NS   | f3-kong-dyndns.jrd.org                                                        | 86400 |    0 |        0 | NULL      | NULL |
| 21 |         5 | jrd.org | MX   | kong.jrd.org                                                                  | 86400 |   10 |        0 | NULL      | NULL |
| 22 |         5 | jrd.org | MX   | g2.jrd.org                                                                    | 86400 |   20 |        0 | NULL      | NULL |
+----+-----------+---------+------+-------------------------------------------------------------------------------+-------+------+----------+-----------+------+
4 rows in set (0.000 sec)

--------------------

root at f3-kong-dyndns /etc/powerdns # pdnsutil check-zone jrd.org
Jan 18 07:15:49 gmysql Connection successful. Connected to database 'powerdns' on 'localhost'.
Jan 18 07:15:49 gmysql Connection successful. Connected to database 'powerdns' on 'localhost'.
Checked 92 records of 'jrd.org', 0 errors, 0 warnings.
root at f3-kong-dyndns /etc/powerdns # dig jrd.org soa @localhost

; <<>> DiG 9.16.22 <<>> jrd.org soa @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58908
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;jrd.org.			IN	SOA

;; ANSWER SECTION:
jrd.org.		86266	IN	SOA	f3-kong-dyndns.jrd.org. postmaster.jrd.org. 2022010900 10800 3600 3600000 86400

;; Query time: 90 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jan 18 07:16:32 EST 2022
;; MSG SIZE  rcvd: 98

root at f3-kong-dyndns /etc/powerdns #
-------------------

    From: frank+pdns at tembo.be
    Date: Tue, 18 Jan 2022 09:46:10 +0100

    Hi,

    The interesting parts are:

    - your full pdns config file (please mask passwords, but nothing besides that)
    - entry for that domain in the domains table
    - SOA / NS records in the records table for that domain
    - output of `pdnsutil check-zone` on that domain.

    That should give us a good starting point, we'll see from there...

    Cheers!

    Frank

        On 17 Jan 2022, at 16:51, jrd-pdns at jrd.org wrote:

        D'oh, my bad.  That must have fallen into my spam trap and I missed
        it.

        Do you want the entire contents of the DB for that zone, or just a
        subset like the SOA and records talking about that host?  Do you want
        it in sql format or zone format?

        What I'm hoping for is a recipe:  "pdns looks for a valid SOA naming
        the local host, and A record for itself, and [fill in the blank].  If
        those conditions are met, it will conlude that it's authoritative".

        I'll collect that stuff up.  Thanks!

           From: frank+pdns at tembo.be
           Date: Mon, 17 Jan 2022 14:20:50 +0100

           Hi,

           Please see my earlier reply (

        https://mailman.powerdns.com/pipermail/pdns-users/2022-January/027513.html
        )

            Hi,

            Could you please paste the full configuration (pdns.conf) and the
            entries in

           the database?

            In particular, the things to look at would be: type of domain set,
            backend

           config, ...

            On top of that, can you run `pdnsutil check-zone` on the zone and
            paste the

           output?

            Frank

               On 17 Jan 2022, at 14:01, jrd via Pdns-users <
               pdns-users at mailman.powerdns.com> wrote:

               Bump.  Anybody?

               If it's in the docs and I missed it, please point me in the right
               direction.  TIA . . .

                  From: jrd-pdns at jrd.org
                  Date: Sun, 9 Jan 2022 17:23:40 -0500

                  Hi all.  I know this is a bit of a newbie question, but it seems
        to be
                  stumping me.

                  I've just set up a new pdns server.  pdns 4.5.1.  I populated
        its DB
                  with a bunch of test records.  I gave it an SOA saying it's the
                  authority for my zone.  Made sure the hostname and IP address
        match
                  the local configuration of the machine.

                  When I query it with (for instance) dig, it returns all the
        correct
                  data, for the SOA or any other of my test records, but it
        doesn't set
                  the AA bit.

                  What are the criteria which have to be met, in order for pdns to
        say
                  "Yep, I'm the authority for this domain" ?

                  TIA . . .
               _______________________________________________
               Pdns-users mailing list
               Pdns-users at mailman.powerdns.com
               https://mailman.powerdns.com/mailman/listinfo/pdns-users

           Frank Louwers
           PowerDNS Certified Consultant @ Kiwazo.be

    Frank Louwers
    PowerDNS Certified Consultant @ Kiwazo.be