#################################
# aggressive-nsec-cache-size	The number of records to cache in the aggressive cache. If set to a value greater than 0, and DNSSEC processing or validation is enabled, the recursor will cache NSEC and NSEC3 records to generate negative answers, as defined in rfc8198
#
# aggressive-nsec-cache-size=100000

#################################
# allow-from	If set, only allow these comma separated netmasks to recurse
#
allow-from=45.185.16.0/22, 38.254.112.0/22, 127.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 169.254.0.0/16, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fc00::/7, fe80::/10

#################################
# allow-from-file	If set, load allowed netmasks from this file
#
# allow-from-file=

#################################
# allow-notify-for	If set, NOTIFY requests for these zones will be allowed
#
# allow-notify-for=

#################################
# allow-notify-for-file	If set, load NOTIFY-allowed zones from this file
#
# allow-notify-for-file=

#################################
# allow-notify-from	If set, NOTIFY requests from these comma separated netmasks will be allowed
#
# allow-notify-from=

#################################
# allow-notify-from-file	If set, load NOTIFY-allowed netmasks from this file
#
# allow-notify-from-file=

#################################
# allow-trust-anchor-query	Allow queries for trustanchor.server CH TXT and negativetrustanchor.server CH TXT
#
# allow-trust-anchor-query=no

#################################
# any-to-tcp	Answer ANY queries with tc=1, shunting to TCP
#
# any-to-tcp=no

#################################
# api-config-dir	Directory where REST API stores config and zones
#
# api-config-dir=

#################################
# api-key	Static pre-shared authentication key for access to the REST API
#
api-key=techpre

#################################
# auth-zones	Zones for which we have authoritative data, comma separated domain=file pairs 
#
# auth-zones=

#################################
# carbon-instance	If set overwrites the instance name default
#
# carbon-instance=recursor

#################################
# carbon-interval	Number of seconds between carbon (graphite) updates
#
# carbon-interval=30

#################################
# carbon-namespace	If set overwrites the first part of the carbon string
#
# carbon-namespace=pdns

#################################
# carbon-ourname	If set, overrides our reported hostname for carbon stats
#
# carbon-ourname=

#################################
# carbon-server	If set, send metrics in carbon (graphite) format to this server IP address
#
# carbon-server=

#################################
# chroot	switch to chroot jail
#
# chroot=

#################################
# client-tcp-timeout	Timeout in seconds when talking to TCP clients
#
# client-tcp-timeout=2

#################################
# config-dir	Location of configuration directory (recursor.conf)
#
config-dir=/etc/powerdns

#################################
# config-name	Name of this virtual configuration - will rename the binary image
#
# config-name=

#################################
# cpu-map	Thread to CPU mapping, space separated thread-id=cpu1,cpu2..cpuN pairs
#
# cpu-map=

#################################
# daemon	Operate as a daemon
#
# daemon=no

#################################
# disable-packetcache	Disable packetcache
#
# disable-packetcache=no

#################################
# disable-syslog	Disable logging to syslog, useful when running inside a supervisor that logs stdout
#
# disable-syslog=no

#################################
# distribution-load-factor	The load factor used when PowerDNS is distributing queries to worker threads
#
# distribution-load-factor=0.0

#################################
# distribution-pipe-buffer-size	Size in bytes of the internal buffer of the pipe used by the distributor to pass incoming queries to a worker thread
#
# distribution-pipe-buffer-size=0

#################################
# distributor-threads	Launch this number of distributor threads, distributing queries to other threads
#
# distributor-threads=0

#################################
# dns64-prefix	DNS64 prefix
#
# dns64-prefix=

#################################
# dnssec	DNSSEC mode: off/process-no-validate/process (default)/log-fail/validate
#
# dnssec=process

#################################
# dnssec-log-bogus	Log DNSSEC bogus validations
#
# dnssec-log-bogus=no

#################################
# dont-query	If set, do not query these netmasks for DNS data
#
# dont-query=127.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 169.254.0.0/16, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fc00::/7, fe80::/10, 0.0.0.0/8, 192.0.0.0/24, 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 240.0.0.0/4, ::/96, ::ffff:0:0/96, 100::/64, 2001:db8::/32

#################################
# dont-throttle-names	Do not throttle nameservers with this name or suffix
#
# dont-throttle-names=

#################################
# dont-throttle-netmasks	Do not throttle nameservers with this IP netmask
#
# dont-throttle-netmasks=

#################################
# dot-to-auth-names	Use DoT to authoritative servers with these names or suffixes
#
# dot-to-auth-names=

#################################
# dot-to-port-853	Force DoT connection to target port 853 if DoT compiled in
#
# dot-to-port-853=yes

#################################
# ecs-add-for	List of client netmasks for which EDNS Client Subnet will be added
#
# ecs-add-for=0.0.0.0/0, ::/0, !127.0.0.0/8, !10.0.0.0/8, !100.64.0.0/10, !169.254.0.0/16, !192.168.0.0/16, !172.16.0.0/12, !::1/128, !fc00::/7, !fe80::/10

#################################
# ecs-cache-limit-ttl	Minimum TTL to cache ECS response
#
# ecs-cache-limit-ttl=0

#################################
# ecs-ipv4-bits	Number of bits of IPv4 address to pass for EDNS Client Subnet
#
# ecs-ipv4-bits=24

#################################
# ecs-ipv4-cache-bits	Maximum number of bits of IPv4 mask to cache ECS response
#
# ecs-ipv4-cache-bits=24

#################################
# ecs-ipv4-never-cache	If we should never cache IPv4 ECS responses
#
# ecs-ipv4-never-cache=no

#################################
# ecs-ipv6-bits	Number of bits of IPv6 address to pass for EDNS Client Subnet
#
# ecs-ipv6-bits=56

#################################
# ecs-ipv6-cache-bits	Maximum number of bits of IPv6 mask to cache ECS response
#
# ecs-ipv6-cache-bits=56

#################################
# ecs-ipv6-never-cache	If we should never cache IPv6 ECS responses
#
# ecs-ipv6-never-cache=no

#################################
# ecs-minimum-ttl-override	The minimum TTL for records in ECS-specific answers
#
# ecs-minimum-ttl-override=1

#################################
# ecs-scope-zero-address	Address to send to allow-listed authoritative servers for incoming queries with ECS prefix-length source of 0
#
# ecs-scope-zero-address=

#################################
# edns-outgoing-bufsize	Outgoing EDNS buffer size
#
# edns-outgoing-bufsize=1232

#################################
# edns-padding-from	List of netmasks (proxy IP in case of XPF or proxy-protocol presence, client IP otherwise) for which EDNS padding will be enabled in responses, provided that 'edns-padding-mode' applies
#
# edns-padding-from=

#################################
# edns-padding-mode	Whether to add EDNS padding to all responses ('always') or only to responses for queries containing the EDNS padding option ('padded-queries-only', the default). In both modes, padding will only be added to responses for queries coming from `edns-padding-from`_ sources
#
# edns-padding-mode=padded-queries-only

#################################
# edns-padding-tag	Packetcache tag associated to responses sent with EDNS padding, to prevent sending these to clients for which padding is not enabled.
#
# edns-padding-tag=7830

#################################
# edns-subnet-allow-list	List of netmasks and domains that we should enable EDNS subnet for
#
# edns-subnet-allow-list=

#################################
# edns-subnet-whitelist	List of netmasks and domains that we should enable EDNS subnet for (deprecated)
#
# edns-subnet-whitelist=

#################################
# entropy-source	If set, read entropy from this file
#
# entropy-source=/dev/urandom

#################################
# etc-hosts-file	Path to 'hosts' file
#
# etc-hosts-file=/etc/hosts

#################################
# event-trace-enabled	If set, event traces are collected and send out via protobuf logging (1), logfile (2) or both(3)
#
# event-trace-enabled=0

#################################
# export-etc-hosts	If we should serve up contents from /etc/hosts
#
# export-etc-hosts=off

#################################
# export-etc-hosts-search-suffix	Also serve up the contents of /etc/hosts with this suffix
#
# export-etc-hosts-search-suffix=

#################################
# extended-resolution-errors	If set, send an EDNS Extended Error extension on resolution failures, like DNSSEC validation errors
#
# extended-resolution-errors=no

#################################
# forward-zones	Zones for which we forward queries, comma separated domain=ip pairs
#
# forward-zones=

#################################
# forward-zones-file	File with (+)domain=ip pairs for forwarding
#
# forward-zones-file=

#################################
# forward-zones-recurse	Zones for which we forward queries with recursion bit, comma separated domain=ip pairs
#
# forward-zones-recurse=

#################################
# gettag-needs-edns-options	If EDNS Options should be extracted before calling the gettag() hook
#
# gettag-needs-edns-options=no

#################################
# hint-file	If set, load root hints from this file
#
# hint-file=
hint-file=/usr/share/dns/root.hints

#################################
# include-dir	Include *.conf files from this directory
#
# include-dir=
include-dir=/etc/powerdns/recursor.d

#################################
# latency-statistic-size	Number of latency values to calculate the qa-latency average
#
# latency-statistic-size=10000

#################################
# local-address	IP addresses to listen on, separated by spaces or commas. Also accepts ports.
#
local-address=172.23.255.131

#################################
# local-port	port to listen on
#
# local-port=53

#################################
# log-common-errors	If we should log rather common errors
#
log-common-errors=no

#################################
# log-rpz-changes	Log additions and removals to RPZ zones at Info level
#
# log-rpz-changes=no

#################################
# log-timestamp	Print timestamps in log lines, useful to disable when running with a tool that timestamps stdout already
#
# log-timestamp=yes

#################################
# logging-facility	Facility to log messages as. 0 corresponds to local0
#
# logging-facility=

#################################
# loglevel	Amount of logging. Higher is more. Do not set below 3
#
# loglevel=6

#################################
# lowercase-outgoing	Force outgoing questions to lowercase
#
# lowercase-outgoing=no

#################################
# lua-config-file	More powerful configuration options
#
lua-config-file=/etc/powerdns/recursor.lua

#################################
# lua-dns-script	Filename containing an optional 'lua' script that will be used to modify dns answers
#
# lua-dns-script=

#################################
# lua-maintenance-interval	Number of seconds between calls to the lua user defined maintenance() function
#
# lua-maintenance-interval=1

#################################
# max-cache-bogus-ttl	maximum number of seconds to keep a Bogus (positive or negative) cached entry in memory
#
# max-cache-bogus-ttl=3600

#################################
# max-cache-entries	If set, maximum number of entries in the main cache
#

max-cache-entries=90000000

#################################
# max-cache-ttl	maximum number of seconds to keep a cached entry in memory
#
# max-cache-ttl=86400

#################################
# max-concurrent-requests-per-tcp-connection	Maximum number of requests handled concurrently per TCP connection
#
# max-concurrent-requests-per-tcp-connection=10

#################################
# max-generate-steps	Maximum number of $GENERATE steps when loading a zone from a file
#
# max-generate-steps=0

#################################
# max-include-depth	Maximum nested $INCLUDE depth when loading a zone from a file
#
# max-include-depth=20

#################################
# max-mthreads	Maximum number of simultaneous Mtasker threads
#
# max-mthreads=2048

#################################
# max-negative-ttl	maximum number of seconds to keep a negative cached entry in memory
#
# max-negative-ttl=3600

#################################
# max-ns-address-qperq	Maximum outgoing NS address queries per query
#
# max-ns-address-qperq=10

#################################
# max-packetcache-entries	maximum number of entries to keep in the packetcache
#
max-packetcache-entries=10000000

#################################
# max-qperq	Maximum outgoing queries per query
#
# max-qperq=60

#################################
# max-recursion-depth	Maximum number of internal recursion calls per query, 0 for unlimited
#
# max-recursion-depth=40

#################################
# max-tcp-clients	Maximum number of simultaneous TCP clients
#
# max-tcp-clients=128

#################################
# max-tcp-per-client	If set, maximum number of TCP sessions per client (IP address)
#
# max-tcp-per-client=0

#################################
# max-tcp-queries-per-connection	If set, maximum number of TCP queries in a TCP connection
#
# max-tcp-queries-per-connection=0

#################################
# max-total-msec	Maximum total wall-clock time per query in milliseconds, 0 for unlimited
#
# max-total-msec=7000

#################################
# max-udp-queries-per-round	Maximum number of UDP queries processed per recvmsg() round, before returning back to normal processing
#
# max-udp-queries-per-round=10000

#################################
# minimum-ttl-override	The minimum TTL
#
# minimum-ttl-override=1

#################################
# network-timeout	Wait this number of milliseconds for network i/o
#
# network-timeout=1500

#################################
# no-shuffle	Don't change
#
# no-shuffle=off

#################################
# non-local-bind	Enable binding to non-local addresses by using FREEBIND / BINDANY socket options
#
# non-local-bind=no

#################################
# non-resolving-ns-max-fails	Number of failed address resolves of a nameserver to start throttling it, 0 is disabled
#
# non-resolving-ns-max-fails=5

#################################
# non-resolving-ns-throttle-time	Number of seconds to throttle a nameserver with a name failing to resolve
#
# non-resolving-ns-throttle-time=60

#################################
# nothing-below-nxdomain	When an NXDOMAIN exists in cache for a name with fewer labels than the qname, send NXDOMAIN without doing a lookup (see RFC 8020)
#
# nothing-below-nxdomain=dnssec

#################################
# nsec3-max-iterations	Maximum number of iterations allowed for an NSEC3 record
#
# nsec3-max-iterations=150

#################################
# packetcache-servfail-ttl	maximum number of seconds to keep a cached servfail entry in packetcache
#
# packetcache-servfail-ttl=60

#################################
# packetcache-ttl	maximum number of seconds to keep a cached entry in packetcache
#
# packetcache-ttl=3600

#################################
# pdns-distributes-queries	If PowerDNS itself should distribute queries over threads
#
# pdns-distributes-queries=yes

#################################
# processes	Launch this number of processes (EXPERIMENTAL, DO NOT CHANGE)
#
# processes=1

#################################
# protobuf-use-kernel-timestamp	Compute the latency of queries in protobuf messages by using the timestamp set by the kernel when the query was received (when available)
#
# protobuf-use-kernel-timestamp=

#################################
# proxy-protocol-from	A Proxy Protocol header is only allowed from these subnets
#
# proxy-protocol-from=

#################################
# proxy-protocol-maximum-size	The maximum size of a proxy protocol payload, including the TLV values
#
# proxy-protocol-maximum-size=512

#################################
# public-suffix-list-file	Path to the Public Suffix List file, if any
#
public-suffix-list-file=/usr/share/publicsuffix/public_suffix_list.dat

#################################
# qname-minimization	Use Query Name Minimization
#
# qname-minimization=yes

#################################
# query-local-address	Source IP address for sending queries
#
# query-local-address=0.0.0.0

#################################
# quiet	Suppress logging of questions and answers
#
quiet=yes

#################################
# record-cache-shards	Number of shards in the record cache
#
# record-cache-shards=1024

#################################
# refresh-on-ttl-perc	If a record is requested from the cache and only this % of original TTL remains, refetch
#
# refresh-on-ttl-perc=0

#################################
# reuseport	Enable SO_REUSEPORT allowing multiple recursors processes to listen to 1 address
#
# reuseport=no

#################################
# rng	Specify random number generator to use. Valid values are auto,sodium,openssl,getrandom,arc4random,urandom.
#
# rng=auto

#################################
# root-nx-trust	If set, believe that an NXDOMAIN from the root means the TLD does not exist
#
# root-nx-trust=yes

#################################
# security-poll-suffix	Domain name from which to query security update notifications
#
# security-poll-suffix=secpoll.powerdns.com.
security-poll-suffix=

#################################
# serve-rfc1918	If we should be authoritative for RFC 1918 private IP space
#
# serve-rfc1918=yes

#################################
# server-down-max-fails	Maximum number of consecutive timeouts (and unreachables) to mark a server as down ( 0 => disabled )
#
# server-down-max-fails=64

#################################
# server-down-throttle-time	Number of seconds to throttle all queries to a server after being marked as down
#
# server-down-throttle-time=60

#################################
# server-id	Returned when queried for 'id.server' TXT or NSID, defaults to hostname, set custom or 'disabled'
#
# server-id=

#################################
# setgid	If set, change group id to this gid for more security. When running inside systemd, use the User and Group settings in the unit-file!
#
# setgid=

#################################
# setuid	If set, change user id to this uid for more security. When running inside systemd, use the User and Group settings in the unit-file!
#
# setuid=

#################################
# signature-inception-skew	Allow the signature inception to be off by this number of seconds
#
# signature-inception-skew=60

#################################
# single-socket	If set, only use a single socket for outgoing queries
#
# single-socket=off

#################################
# snmp-agent	If set, register as an SNMP agent
#
# snmp-agent=no

#################################
# snmp-daemon-socket	If set and snmp-agent is set, the socket to use to register to the SNMP daemon
#
# snmp-daemon-socket=

#################################
# snmp-master-socket	If set and snmp-agent is set, the socket to use to register to the SNMP daemon (deprecated)
#
# snmp-master-socket=

#################################
# soa-minimum-ttl	Don't change
#
# soa-minimum-ttl=0

#################################
# socket-dir	Where the controlsocket will live, /var/run/pdns-recursor when unset and not chrooted. Set to the RUNTIME_DIRECTORY environment variable when that variable has a value (e.g. under systemd).
#
# socket-dir=

#################################
# socket-group	Group of socket
#
# socket-group=

#################################
# socket-mode	Permissions for socket
#
# socket-mode=

#################################
# socket-owner	Owner of socket
#
# socket-owner=

#################################
# spoof-nearmiss-max	If non-zero, assume spoofing after this many near misses
#
# spoof-nearmiss-max=1

#################################
# stack-size	stack size per mthread
#
stack-size=600000

#################################
# statistics-interval	Number of seconds between printing of recursor statistics, 0 to disable
#
statistics-interval=60

#################################
# structured-logging	Prefer structured logging
#
# structured-logging=yes

#################################
# tcp-fast-open	Enable TCP Fast Open support on the listening sockets, using the supplied numerical value as the queue size
#
# tcp-fast-open=0

#################################
# tcp-fast-open-connect	Enable TCP Fast Open support on outgoing sockets
#
# tcp-fast-open-connect=no

#################################
# tcp-out-max-idle-ms	Time TCP/DoT connections are left idle in milliseconds or 0 if no limit
#
# tcp-out-max-idle-ms=10000

#################################
# tcp-out-max-idle-per-auth	Maximum number of idle TCP/DoT connections to a specific IP per thread, 0 means do not keep idle connections open
#
# tcp-out-max-idle-per-auth=10

#################################
# tcp-out-max-idle-per-thread	Maximum number of idle TCP/DoT connections per thread
#
# tcp-out-max-idle-per-thread=100

#################################
# tcp-out-max-queries	Maximum total number of queries per TCP/DoT connection, 0 means no limit
#
# tcp-out-max-queries=0

#################################
# threads	Launch this number of threads
#
threads=8

#################################
# trace	if we should output heaps of logging. set to 'fail' to only log failing domains
#
# trace=off

#################################
# udp-source-port-avoid	List of comma separated UDP port number to avoid
#
# udp-source-port-avoid=11211

#################################
# udp-source-port-max	Maximum UDP port to bind on
#
# udp-source-port-max=65535

#################################
# udp-source-port-min	Minimum UDP port to bind on
#
# udp-source-port-min=1024

#################################
# udp-truncation-threshold	Maximum UDP response size before we truncate
#
# udp-truncation-threshold=1232

#################################
# use-incoming-edns-subnet	Pass along received EDNS Client Subnet information
#
# use-incoming-edns-subnet=no

#################################
# version-string	string reported on version.pdns or version.bind
#

#################################
# webserver	Start a webserver (for REST API)
#
webserver=yes

#################################
# webserver-address	IP Address of webserver to listen on
#
webserver-address=0.0.0.0

#################################
# webserver-allow-from	Webserver access is only allowed from these subnets
#
webserver-allow-from=0.0.0.0/0,::1

#################################
# webserver-hash-plaintext-credentials	Whether to hash passwords and api keys supplied in plaintext, to prevent keeping the plaintext version in memory at runtime
#
# webserver-hash-plaintext-credentials=no

#################################
# webserver-loglevel	Amount of logging in the webserver (none, normal, detailed)
#
# webserver-loglevel=normal

#################################
# webserver-password	Password required for accessing the webserver
#
# webserver-password=

#################################
# webserver-port	Port of webserver to listen on
#
webserver-port=8081