[Pdns-users] failover on NXDOMAIN

[Pavel Prostin]

Dear All,

I’m trying to configure the PowerDNS recursor to failover on NXDOMAIN. Here
is the scenario:

There are two DNS zones: internal and external. The problem is that *.
example.com can either be used for an internal or an external host, and
thus the record can exist on any DNS server.

Possible workaround: A client tries to resolve the hostname using the
primary (internal) DNS first. If the internal DNS server has no record or
cannot resolve the host because it is external and returns NXDOMAIN
(non-existent domain), a second request is then made to the alternate
(external) DNS server (this is not the secondary DNS fallback) to resolve
the domain/host.

I understand that this approach is not RFC-compliant and is not the
recommended solution (e.g., using .internal.example.com for internal
hosts). However, I attempted to implement it using a custom LUA script (see
below), which unfortunately does not work as intended.

Is the intended solution feasible and scalable?

Thank you for your assistance.

Best regards,


-- /etc/powerdns/nxdomain_failover.lua

function postresolve(dq)
  -- Log the original query result
  pdnslog("Original query result: " .. dq.qname:toString() .. " " ..
dq.qtype:toString() .. " RCODE: " .. dq.rcode, pdns.loglevels.Info)

  if dq.rcode == pdns.NXDOMAIN then
    -- Create a new DNS question for the fallback DNS server
    local fallback_dq = newDNSQuestion(dq.qname, dq.qtype)
    fallback_dq.remoteaddr = newCAres("8.8.8.8", "53")

    -- Query the fallback DNS server
    fallback_result = fallback_dq:doResolve()

    -- Log the fallback query result
    pdnslog("Fallback query result: " .. fallback_dq.qname:toString() .. "
" .. fallback_dq.qtype:toString() .. " RCODE: " .. fallback_result.rcode,
pdns.loglevels.Info)

    if fallback_result.rcode == pdns.NOERROR then
      -- Replace the original NXDOMAIN response with the fallback response
      dq:addAnswer(fallback_result)
      return true
    end
  end
  return false
end
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.powerdns.com/pipermail/pdns-users/attachments/20250207/75cfbc4e/attachment.htm>