PowerDNS - ArchWiki

Jump to content

# PowerDNS

From ArchWiki

PowerDNS is a DNS server, written in C++ and licensed under the GPL. PowerDNS features a large number of different backends ranging from simple BIND style zonefiles to relational databases and load balancing/failover algorithms.

## Installation

Install the powerdns package.

Next you can review the configuration file located at `/etc/powerdns/pdns.conf`.

## Backends

To configure PowerDNS to use specific backend you will need to set the `launch` option in configuration file. Also depending on particular backend you use, you will have to configure it.

For PostgreSQL, MySQL and SQLite you can find database table creation SQL files located at `/usr/share/doc/powerdns`.

### PostgreSQL backend

Firstly you will need to create a user and database where PowerDNS can store data, then import the schema:

    $ psql -U <user> -d <database name> -a -f /usr/share/doc/powerdns/schema.pgsql.sql

And finally update configuration file to use the backend:

    /etc/powerdns/pdns.conf

    launch=gpgsql
    gpgsql-host=/run/postgresql # if PostgreSQL is listening to unix socket
    # gpgsql-host=127.0.0.1
    # gpgsql-port=5432
    gpgsql-dbname=<database name>
    gpgsql-user=<user to use>
    gpgsql-password=
    # Uncomment for dnssec support
    #gpgsql-dnssec=yes

### MySQL backend

Install and run a MySQL server. Create a new user, and a new database and import the schema into the db:

    $ mysql -u root -p pdns < /usr/share/doc/powerdns/schema.mysql.sql

Then, configure Powerdns to use MySQL:

    /etc/powerdns/pdns.conf

    launch=gmysql
    gmysql-host=127.0.0.1
    gmysql-socket=/run/mysqld/mysqld.sock
    gmysql-user=pdns
    gmysql-password=Pa$$w0rd
    gmysql-dbname=pdns
    # Uncomment for dnssec support
    #gmysql-dnssec=yes

You could also use localhost instead of 127.0.0.1, but this causes PowerDNS to use the socket file. As PowerDNS runs in a chroot by default, the socket file is not available.

### SQLite backend

Configure Powerdns to use sqlite:

    /etc/powerdns/pdns.conf

    launch=gsqlite3
    gsqlite3-database=/var/lib/powerdns/pdns.sqlite3
    # Uncomment for dnssec support
    #gsqlite3-dnssec=yes

Create the database:

    # mkdir /var/lib/powerdns
    # sqlite3 /var/lib/powerdns/pdns.sqlite3 < /usr/share/doc/powerdns/schema.sqlite3.sql
    # chown -R powerdns:powerdns /var/lib/powerdns

## Startup

Start/enable `pdns.service`.

## Zone management

PowerDNS comes with pdnsutil(1) utility to easily manage hosted zones.

Create a new, empty zone:

    [powerdns]$ pdnsutil create-zone example.net

To edit the zone:

    [powerdns]$ pdnsutil edit-zone example.net

Note `EDITOR` environment variable must be set to be able edit the zone this way.
Warning When editing the zone, all names must be in fully-qualified form, without trailing dot (e.g. `www.example.net`).

Upon saving and quitting the editor, you will be asked for confirmation to commit the changes. Carefully read the shown diff and only press `a` when you're certain that the change is correct. If you keep SOA record unchanged, you'll also be asked whether to increase serial number or not. In most cases, you can simply reply with `y`, which bumps the number.

When you want to no longer serve the zone, you can remove it from the backend:

    [powerdns]$ pdnsutil delete-zone example.net

## DNSSEC

PowerDNS has easy-to-use facilities to serve DNSSEC-signed zone with minimal administrative overhead. It takes advantage of online signing architecture, which generates signatures on-demand when queries come from Internet.

For most cases, turning existing insecure zone into DNSSEC-signed one is as simply as:

    [powerdns]$ pdnsutil secure-zone example.net

This will sign the zone with single (CSK) ECDSA 256-bit (algorithm 13) key with NSEC denial-of-existence.

For more flexibility on key generation, `pdnsutil add-zone-key` command can be used instead. For example, to generate traditional KSK/ZSK split ECDSA 256-bit keys:

    [powerdns]$ pdnsutil add-zone-key example.net ksk active published ecdsa256
    [powerdns]$ pdnsutil add-zone-key example.net zsk active published ecdsa256
    [powerdns]$ pdnsutil increase-serial example.net

To view DS records (and other zone information):

    [powerdns]$ pdnsutil show-zone example.dns

Submit DS to the parent zone (e.g. by filling the web form on your registrar).

Note In primary/secondary setup, DNSSEC-signed zones are served as pre-signed zones on secondaries. This can alleviate CPU load on secondaries as these zones' signatures were generated in online signing mode on primary (which can be set up as stealth one) during zone transfer.
Warning PowerDNS currently doesn't have automatic key management feature. If you want to roll keys, see the upstream guide (for KSK, for ZSK, and for algorithm rollovers) to avoid pitfalls that can cause your zone being bogus.

## Tips and tricks

### Bind address and/or port

The default `/etc/powerdns/pdns.conf` binds to 0.0.0.0:53 (all IP addresses). This will conflict with any other process bound to port 53, for example `systemd-resolved` uses 127.0.0.53:53. This will result in an error:

    Unable to bind UDP socket to '0.0.0.0:53': Address already in use

This can be resolved in a number of ways, for example changing either/both `local-address` or `local-port` options:

    /etc/powerdns/pdns.conf

    local-address=127.0.0.1:54

### Zone replication via AXFR (primary/secondary setup)

By default, zones in PowerDNS are native, which means that zone replication is handled by the backend. It is only make sense for MySQL and PostgreSQL backends as they have database replication facility.

You can also configure PowerDNS in classical primary/secondary setup. First, enable appropriate mode in `/etc/powerdns/pdns.conf`.

On primary:

    /etc/powerdns/pdns.conf

    primary=yes
    allow-axfr-ips=10.20.30.50/32

On secondary:

    /etc/powerdns/pdns.conf

    secondary=yes
    allow-notify-from=10.20.30.40/32

where `10.20.30.40` and `10.20.30.50` are IP addresses of primary and secondary, respectively.

Restart `pdns.service`.

Set the zone type on primary as primary zone:

    [powerdns]$ pdnsutil set-kind example.net primary

On secondary, create the secondary zone, specifying primary's IP address to retrieve from:

    [powerdns]$ pdnsutil create-secondary-zone example.net 10.20.30.40

The zone will be transferred after a while.

#### TSIG authentication

You can also authenticate zone transfers with TSIG keys.

On primary, generate hmac-sha256 key:

    [powerdns]$ pdnsutil generate-tsig-key example hmac-sha256
    Create new TSIG key example <secret>

Enable the key for primary zone's outgoing transfer:

    [powerdns]$ pdnsutil activate-tsig-key example.net example primary

On secondary, import the key:

    [powerdns]$ pdnsutil import-tsig-key example hmac-sha256 '<secret>'

Enable the key for secondary zone's transfer request:

    [powerdns]$ pdnsutil activate-tsig-key example.net example secondary

## See also

- PowerDNS manual

Category:

- Domain Name System

PowerDNS
Add topic