PowerDNS Recursor

Next topic

This Page

PowerDNS Recursor¶

Introduction
- Notable features
- Getting support
- Third party software
  - Protozero
Getting Started
- Installation
- Configuring PowerDNS Recursor
- Using Ansible
Operating PowerDNS Recursor
- Logging
  - Logging to syslog
- Cache Management
- Tracing Queries
- Logging details of queries and answers
DNSSEC in the PowerDNS Recursor
- DNSSEC settings
- Trust Anchor Management
  - Trust Anchors
  - Negative Trust Anchors
PowerDNS Recursor Settings
- The Settings
PowerDNS Recursor New Style (YAML) Settings
- YAML settings file
- Merging multiple setting files
- Description of YAML syntax for structured types
- Description of YAML syntax corresponding to Lua config items
- The YAML settings
Advanced Configuration Using Lua
- Managing DNSSEC Trust Anchors in the Lua Configuration
- Logging DNS messages with Protocol Buffers
- Response Policy Zones (RPZ)
- Evaluation order
- Configuring RPZ
  - Extended Errors
- RPZ Configuration Functions
- RPZ settings
- Extra settings for rpzPrimary
  - tsigname
  - tsigalgo
  - tsigsecret
  - refresh
  - maxReceivedMBytes
  - localAddress
  - axfrTimeout
  - dumpFile
  - seedFile
- Policy Actions
- Using Sortlist
  - addSortList
- Zone to Cache
- Adding Additional Records to Results
  - Configuring additional record processing
- Table Based Proxy Mapping
Scripting PowerDNS Recursor
- Configuring Lua scripts
- The DNSQuestion (dq) object
- DNSHeader Object
- DNSRecord Object
- The EDNSOptionView Class
- The ProxyProtocolValue Class
- DNS names and comparing them
  - The DNSName object
  - DNS Suffix Match Group
- DNS Record
- The ComboAddress class
- Netmasks and NetMaskGroups
  - Netmask class
  - NetMaskGroup class
- Policy Events
  - PolicyEvent class
- Lua Scripting and Statistics
  - Generating Metrics
  - Looking at Statistics
- Logging from the Lua scripts
- Intercepting queries with Lua
- Lua FFI API
  - Functions for gettag_ffi()
  - Functions for postresolve_ffi()
- Other functions
- Checking available features
DNS64 support
- Native DNS64 support
- Scripted DNS64 Support
Metrics and Statistics
- Regular Statistics Log
- Multi-threading and metrics
- Sending metrics to Graphite/Metronome over Carbon
- Getting Metrics from the Recursor
- Sending metrics over SNMP
- Gathered Information
Performance Guide
- Threading and distribution of queries
  - Imbalance
  - Non-Linux systems
- MTasker and MThreads
- Performance tips
- Memory usage
- Connection tracking and firewalls
- Tuning Incoming TCP and Out-of-Order processing
- TCP Fast Open Support
- Running with a local root zone
- Recursor Caches
- Measuring performance
- Event Tracing
  - OpenTelemetry Traces
Manual Pages
- pdns_recursor
  - Synopsis
  - Description
  - Examples
  - Options
  - See also
- rec_control
  - Synopsis
  - Description
  - Examples
  - Options
  - Commands
  - See also
Built-in Webserver and HTTP API
- Data format
- Server
- Zones
  - Zone
  - RRSet
  - RREntry
  - Comment
- ConfigSetting
- StatisticItem
- Webserver
- Enabling the API
- URL Endpoints
Security of the PowerDNS Recursor
- PowerDNS Security Policy
  - YesWeHack
  - Disclosure Policy
- Anti-spoofing
- Throttling
- Security Polling
  - Details
Security Advisories
- PowerDNS Security Advisory 2025-06: Crafted delegations or IP fragments can poison cached delegations in Recursor
- PowerDNS Security Advisory 2025-04: A Recursor configured to send out ECS enabled queries can be sensitive to spoofing attempts
- PowerDNS Security Advisory 2025-01: A crafted zone can lead to an illegal memory access in the Recursor
- PowerDNS Security Advisory 2024-04: Crafted responses can lead to a denial of service due to cache inefficiencies in the Recursor
- PowerDNS Security Advisory 2024-02: if recursive forwarding is configured, crafted responses can lead to a denial of service in Recursor
- PowerDNS Security Advisory 2024-01: crafted DNSSEC records in a zone can lead to a denial of service in Recursor
- PowerDNS Security Advisory 2023-02: Deterred spoofing attempts can lead to authoritative servers being marked unavailable
- PowerDNS Security Advisory 2023-01: unbounded recursion results in program termination
- PowerDNS Security Advisory 2022-02: incomplete exception handling related to protobuf message generation
- PowerDNS Security Advisory 2022-01: incomplete validation of incoming IXFR transfer in Authoritative Server and Recursor
- PowerDNS Security Advisory 2020-07: Cache pollution
- PowerDNS Security Advisory 2020-04: Access restriction bypass
- PowerDNS Security Advisory 2020-03: Information disclosure
- PowerDNS Security Advisory 2020-02: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2020-01: Denial of Service
- PowerDNS Security Advisory 2019-02: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2019-01: Lua hooks are not applied in certain configurations
- PowerDNS Security Advisory 2018-09: Crafted query can cause a denial of service
- PowerDNS Security Advisory 2018-07: Crafted query for meta-types can cause a denial of service
- PowerDNS Security Advisory 2018-06: Packet cache pollution via crafted query
- PowerDNS Security Advisory 2018-04: Crafted answer can cause a denial of service
- PowerDNS Security Advisory 2018-01: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2017-08: Crafted CNAME answer can cause a denial of service
- PowerDNS Security Advisory 2017-07: Memory leak in DNSSEC parsing
- PowerDNS Security Advisory 2017-06: Configuration file injection in the API
- PowerDNS Security Advisory 2017-05: Cross-Site Scripting in the web interface
- PowerDNS Security Advisory 2017-03: Insufficient validation of DNSSEC signatures
- PowerDNS Security Advisory 2016-04: Insufficient validation of TSIG signatures
- PowerDNS Security Advisory 2016-02: Crafted queries can cause abnormal CPU usage
- PowerDNS Security Advisory 2015-01: Label decompression bug can cause crashes or CPU spikes
- PowerDNS Security Advisory 2014-02: PowerDNS Recursor 3.6.1 and earlier can be made to provide bad service
- PowerDNS Security Advisory 2014-01: PowerDNS Recursor 3.6.0 can be crashed remotely
- PowerDNS Security Advisory 2010-02: PowerDNS Recursor up to and including 3.1.7.1 can be spoofed into accepting bogus data
- PowerDNS Security Advisory 2010-01: PowerDNS Recursor up to and including 3.1.7.1 can be brought down and probably exploited
- PowerDNS Security Advisory 2008-01: System random generator can be predicted, leading to the potential to ‘spoof’ PowerDNS Recursor
- PowerDNS Security Advisory 2006-02: Zero second CNAME TTLs can make PowerDNS exhaust allocated stack space, and crash
- PowerDNS Security Advisory 2006-01: Malformed TCP queries can lead to a buffer overflow which might be exploitable
- Older security advisories
Upgrade Guide
- 5.3.0 to master
  - New Settings
  - rec_control
- 5.2.0 to 5.3.0
  - Changed behaviour
  - New Settings
  - Changed Settings
- 5.0.12, 5.1.6, 5.2.4 and 5.3.0
  - New settings
- 5.1.0 to 5.2.0
  - Changed behaviour
  - Changed settings
  - New Settings
- 5.1.2 to 5.1.3
  - New Settings
- 5.1.1 to 5.1.2, 5.0.8 to 5.0.9 and 4.9.8 to 4.9.9
  - New settings
- 5.0.6 to 5.1.0
  - New settings
  - Changed settings
- 5.0.5 to 5.0.6
  - Changed settings
- 5.0.4 to 5.0.5
- Changed settings
- 5.0.2 to 5.0.3, 4.9.3 to 4.9.4 and 4.8.6 to 4.8.7
  - Known issue solved
- 5.0.1 to 5.0.2, 4.9.2 to 4.9.3 and 4.8.5 to 4.8.6
  - Known issues
  - New settings
- 4.9.0 to 5.0.0
  - YAML settings
  - Rust
  - New settings
  - Changed settings
- 4.8.0 to 4.9.0
  - Metrics
  - New settings
  - Changed settings
  - rec_control
- 4.8.1 to 4.8.2
  - Cache eviction policy
- 4.7.0 to 4.8.0
  - Structured logging
  - New settings
  - pdns_recursor changes
  - rec_control changes
- 4.7.2 to 4.7.3
  - New settings
- 4.6.2 to 4.7.0
  - Zone to Cache Changes
  - Asynchronous retrieval of AAAA records for nameservers
  - New Lua Configuration Functions
  - Post Resolve FFI Function
  - New settings
  - rec_control changes
- 4.6.3 to 4.6.4
  - New settings
- 4.6.1 to 4.6.2
  - Deprecated and changed settings
- 4.5.x to 4.6.1
  - Offensive language
  - File descriptor usage
  - New settings
  - Deprecated and changed settings
  - Privileged port binding in Docker
- 4.5.10 to 4.5.11
  - New settings
- 4.5.1 to 4.5.2
  - Deprecated and changed settings
- 4.4.x to 4.5.1
  - Offensive language
  - Special domains
  - rec_control command writing to a file
  - New settings
  - Deprecated and changed settings
  - Removed settings
- 4.3.x to 4.4.0
  - Response Policy Zones (RPZ)
  - Dropping queries from Lua callbacks
  - Parsing of unknown record types
  - Deprecated and changed settings
  - New settings
- 4.2.x to 4.3.0
  - Lua Netmask class methods changed
  - socket-dir changed
  - Systemd service and permissions
  - New settings
- 4.1.x to 4.2.0
- 4.0.x to 4.1.0
- 4.0.3 to 4.0.4
- 4.0.0 to 4.0.1
Changelogs
- Changelogs for 5.3.X
  - 5.3.1
  - 5.3.0
  - 5.3.0-rc1
  - 5.3.0-beta1
  - 5.3.0-alpha2
  - 5.3.0-alpha1
- Changelogs for 5.2.X
  - 5.2.6
  - 5.2.5
  - 5.2.4
  - 5.2.3
  - 5.2.2
  - 5.2.1
  - 5.2.0
  - 5.2.0-rc1
  - 5.2.0-beta1
  - 5.2.0-alpha1
- Changelogs for 5.1.X
  - 5.1.8
  - 5.1.7
  - 5.1.6
  - 5.1.5
  - 5.1.4
  - 5.1.3
  - 5.1.2
  - 5.1.1
  - 5.1.0
  - 5.1.0-rc1
  - 5.1.0-beta1
  - 5.1.0-alpha1
- Changelogs for 5.0.X
  - 5.0.12
  - 5.0.11
  - 5.0.10
  - 5.0.9
  - 5.0.8
  - 5.0.7
  - 5.0.6
  - 5.0.5
  - 5.0.4
  - 5.0.3
  - 5.0.2
  - 5.0.1
  - 5.0.0-rc2
  - 5.0.0-rc1
  - 5.0.0-beta1
  - 5.0.0-alpha2
  - 5.0.0-alpha1
- Changelogs for 4.9.X
  - 4.9.9
  - 4.9.8
  - 4.9.7
  - 4.9.6
  - 4.9.5
  - 4.9.4
  - 4.9.3
  - 4.9.2
  - 4.9.1
  - 4.9.0
  - 4.9.0-rc1
  - 4.9.0-beta1
  - 4.9.0-alpha1
- Changelogs for 4.8.X
  - 4.8.9
  - 4.8.8
  - 4.8.7
  - 4.8.6
  - 4.8.5
  - 4.8.4
  - 4.8.3
  - 4.8.2
  - 4.8.1
  - 4.8.0
  - 4.8.0-rc1
  - 4.8.0-beta2
  - 4.8.0-beta1
  - 4.8.0-alpha1
- Changelogs for 4.7.X
  - 4.7.6
  - 4.7.5
  - 4.7.4
  - 4.7.3
  - 4.7.2
  - 4.7.1
  - 4.7.0
  - 4.7.0-rc1
  - 4.7.0-beta1
  - 4.7.0-alpha1
- Changelogs for 4.6.X
  - 4.6.6
  - 4.6.5
  - 4.6.4
  - 4.6.3
  - 4.6.2
  - 4.6.1
  - 4.6.0
  - 4.6.0-rc1
  - 4.6.0-beta2
  - 4.6.0-beta1
  - 4.6.0-alpha2
  - 4.6.0-alpha1
- Changelogs for 4.5.X
  - 4.5.12
  - 4.5.11
  - 4.5.10
  - 4.5.9
  - 4.5.8
  - 4.5.7
  - 4.5.6
  - 4.5.5
  - 4.5.4
  - 4.5.2
  - 4.5.1
  - 4.5.0
  - 4.5.0-rc1
  - 4.5.0-beta2
  - 4.5.0-beta1
  - 4.5.0-alpha3
  - 4.5.0-alpha2
  - 4.5.0-alpha1
- Changelogs for 4.4.x
  - 4.4.8
  - 4.4.7
  - 4.4.6
  - 4.4.5
  - 4.4.4
  - 4.4.3
  - 4.4.2
  - 4.4.1
  - 4.4.0
  - 4.4.0-rc2
  - 4.4.0-rc1
  - 4.4.0-beta1
  - 4.4.0-alpha2
  - 4.4.0-alpha1
- Changelogs for 4.3.x
  - 4.3.7
  - 4.3.6
  - 4.3.5
  - 4.3.4
  - 4.3.3
  - 4.3.2
  - 4.3.1
  - 4.3.0
  - 4.3.0-rc2
  - 4.3.0-rc1
  - 4.3.0-beta2
  - 4.3.0-beta1
  - 4.3.0-alpha3
  - 4.3.0-alpha2
  - 4.3.0-alpha1
- Changelogs for 4.2.x
  - 4.2.5
  - 4.2.4
  - 4.2.3
  - 4.2.2
  - 4.2.1
  - 4.2.0
  - 4.2.0-rc2
  - 4.2.0-rc1
  - 4.2.0-beta1
  - 4.2.0-alpha1
- Changelogs for 4.1.x
  - 4.1.18
  - 4.1.17
  - 4.1.16
  - 4.1.15
  - 4.1.14
  - 4.1.13
  - 4.1.12
  - 4.1.11
  - 4.1.10
  - 4.1.9
  - 4.1.8
  - 4.1.7
  - 4.1.6
  - 4.1.5
  - 4.1.4
  - 4.1.3
  - 4.1.2
  - 4.1.1
  - 4.1.0
  - 4.1.0-rc3
  - 4.1.0-rc2
  - 4.1.0-rc1
  - 4.1.0-alpha1
- Changelogs for 4.0.x
- Changelogs for all pre 4.0 releases
Newly Observed Domain Tracking
- Logging
- DNS Lookup
- Protobuf Logging
Unique Domain Response
- Logging
- Protobuf Logging
End of life statements
Frequently Asked Questions
- EDNS bufsize in response packets
- Handling of root hints
Compiling PowerDNS Recursor
- Getting the sources
- Dependencies
- Compiling from a git checkout
- macOS Notes
- Optional dependencies
- Documentation
Cryptographic software and export control
- Specific United States Export Control Notes
Internals of the PowerDNS Recursor
- The PowerDNS Recursor
- Synchronous code using MTasker
- MPlexer
- MOADNSParser
- The C++ Standard Library / Boost
- Actual DNS Algorithm
  - The non-cached case
- QName Minimization
- Some of the things we glossed over
- The Recursor Cache
- Serve Stale
- Some small things
Structured Logging Dictionary
- The default backend
- The systemd-journal backend
- The json backend
Conversion of old-style settings to YAML format
- Example
- API Managed Files
PowerDNS/dnsdist license