pdnsd

Related articles
Domain name resolution
pdnsd
is a DNS server designed for local caching of DNS information. Correctly configured, it can significantly increase browsing speed on a broadband connection. Compared to
BIND
or
dnsmasq
it can remember its cache after a reboot; "p" stands for persistent. See
Domain name resolution#DNS servers
for comparison with other DNS servers.
Installation
Install
the
pdnsd
package.
Configuration
The package comes with a sample configuration file at
/usr/share/doc/pdnsd/pdnsd.conf
. The customized configuration file should be created at
/etc/pdnsd.conf
.
Format
The
pdnsd.conf
file uses a fairly simple format, but it has some differences from most other configuration files you have likely encountered. It has a collection of sections of various types. A section is started with the name of the type of section and an opening curly bracket (
{
) and is ended by a closing curly bracket (
}
). Sections cannot be nested.
Inside each block is a series of options of the following format:
option_name=option_value;
Notice the semicolon at the end; unlike some formats, it is not optional.
Comments are started with either
#
or
/*
. The former goes to the end of the line, the latter continues until it reaches
*/
.
DNS servers
pdnsd needs to know the address of at least one DNS server to collect DNS information from. This part of the setup differs depending on whether you have a broadband connection or dial-up. Broadband users should use the first server section as a starting point, dial-up users the second, leaving the other server sections commented out.
label
The
label
option is used to uniquely identify a server section. It is completely arbitrary, but one good choice is the name of your ISP.
ip
This option, used in the default broadband configuration, tells pdnsd the addresses of DNS servers to use. Multiple addresses should be separated by a single comma, with optional whitespace before or after the comma. You can just copy the addresses from
/etc/resolv.conf
.
file
The
file
option can be used instead of
ip
to specify a set of DNS server IPs. Its value is the path to a file with servers listed in
resolv.conf
format. The default dial-up configuration uses it because the PPP client writes
/etc/ppp/resolv.conf
with the addresses it gets from the PPP server. You should not need to change it unless you want to use a different DNS server than your ISP gives you by default.
interface
The network interface for the uptest=if option.  This defaults to eth0, which is most likely incorrect.  If the pdnsd service is started but not returning any DNS records, this may be set wrong.
The rest of the server section will work without any more changes. For details on all the available options, see the
pdnsd manual
.
DNS servers with DHCP connections
When
netctl
is installed, pdnsd can be notified of the ip addresses of the name servers by
openresolv
and the notifications become dynamic when you use
Automatic switching of profiles
.
To configure this feature, remove the broadband server section and update the dial-up server section with the following changes:
label = resolvconf;
   file = /etc/pdnsd-resolv.conf;
Edit
/etc/resolvconf.conf
to configure
openresolv
with pdnsd as one of its subscribers:
name_servers=127.0.0.1
pdnsd_resolv=/etc/pdnsd-resolv.conf
And run
resolvconf -u
to update
/etc/pdnsd-resolv.conf
with the addresses of the name servers (ignore the error message saying that the pdnsd socket cannot be accessed). This updating is only needed once before starting manually pdnsd.
OpenDNS
The
pdnsd.conf
file comes with OpenDNS settings built in; you can simply remove (or comment out) the dialup and broadband sections above it (being careful not to remove the necessary global setup at the very top of the file), and then uncomment it to use OpenDNS resolution.
However, OpenDNS does some weird things to Google. You need to deny results from OpenDNS that return one of OpenDNS’s Google-proxy machines if you want to avoid this behaviour (for many people, it can increase Google requests from, say, 15ms, to 75ms+). The exact servers’ IPs change, but you can run a
drill www.google.com @208.67.222.222
(provided by
ldns
) to find the current IPs. You will know if the query is being proxied, because the server’s name will resolve to something like
google.navigation.opendns.com
. On one try, these addresses were
208.67.216.230
and
208.67.216.231
.
Once you know the IPs, you can replace the
pdnsd.conf
’s already-existant
rejected
IPs inside the OpenDNS
server { …
} declaration. Make sure you retain the prefixes.
OpenNIC
is a reliable alternative to OpenDNS.
Note
This example uses OpenDNS servers. Replace it with a DNS resolver you trust. See
Domain name resolution#Third-party DNS services
.
Testing
You should now have a working
pdnsd
daemon. Start it.
Test
that it is now working.
For the second time you look up any address using
127.0.0.1
, query time should be under 1 ms.
System setup
Make sure to
enable
pdnsd.service
.
It starts right after
network.target
, as services that use the network rely on a working DNS, i.e.
network-online.target
(see the
upstream explanation
).
For any PC with two or more NICs to have pdnsd operational for any wired and wireless connection please configure separate profile for each NIC in
pdnsd.conf
by specifying correct
interface
.
Tips and tricks
Performance settings for home broadband users
Many users have broadband connections where the DNS server is slow or unreliable, and would like to use
pdnsd
as a caching server to minimize the number of DNS queries that need to be made.  After doing the setup detailed above, the following settings in the
/etc/pdnsd.conf
will help improve the performance in this role:
Under global settings:
neg_rrs_pol=on;
par_queries=1;
Under server settings:
proxy_only=on;
purge_cache=off;
The
neg_rrs_pol=on;
policy means that when a negative response comes back for a query, pdnsd server will still cache the result even if the response is not "authoritative".  This is important since watching DNS queries will reveal that there are many requests for AAAA records (DNS queries for IPv6) which will never return results since many domains are not using IPv6, as well as MX records since not every domain has an MX record.  Without the negative caching, these requests will be sent even after a domain name has been cached, and in this role you do not want the extra DNS requests being made. It is important to use this option in conjunction with the
proxy_only=on;
option to minimize the number of queries coming out of the system.
The
par_queries=1;
option is useful if you specify more than one DNS server in your "server" section below.  It specifies an increment of how many parallel queries will be made at once.  For example, if four DNS servers are listed in the "server" section, and
par_queries=2;
(the default), then the first 2 servers will be queried simultaneously, and if both of the first two servers fail,
pdnsd
will move on to the next two and query them simultaneously.   The setting used above means that one DNS server at a time gets queried, so you can list two or more DNS servers in the "server" section, and the second one will only be queried if the first one fails.  This helps minimize traffic, but if the first server fails you will have to wait through the timeout before the second server will be queried.  Tweak this setting for your own preferences, and if you only specify one server in the "server" section then you do not need to worry about it.
The
proxy_only=on;
setting is mentioned below in the FAQ and is important for home broadband users since you generally are using only one or two DNS servers instead of trying to do the full-blown hierarchical name resolution that a full DNS server would do. This setting will prevent
pdnsd
from resolving all the way back to the "authoritative" name server, and instead accept the results of the DNS servers that were already specified in the "server" section. Once again, this reduces the number of DNS queries you need to make, improving performance.
The
purge_cache=off;
setting tells
pdnsd
not to remove cache entries even if they have outlived the DNS record's time-to-live metric.  This can be very useful when your ISP's DNS server goes down and you want to be able to access name lookups for domains you frequently use despite the outage. Records will still be bumped out of the cache based on age once the cache becomes full (see
pdnsd.conf(5)
on how to set the size of the cache).
Additional performance settings
TTLs (Time-To-Live)
Each DNS resource record returned from a server includes a maximum time-to-live, or TTL.  This tells the recipient how long to store the record and when to do a new lookup on it. Many DNS records have relatively short TTLs, such as 3600 (one hour). This means that after one hour, pdnsd will attempt a new lookup on this entry, regardless of whether it has a cached record for it available. It will improve performance to override this default TTL by setting a global minimum TTL, causing fewer lookups to be performed.  The disadvantage to using a minimum TTL that is too long is that a cached record may be out of date (the IP address of the host may be changed, but your client will not know this because it will receive the cached address).  However, most IP addresses do not change hourly or even daily.
Times are specified in seconds by default, or you may append an "m", "h", "d", or "w" to the time to specify minutes, hours, days, or weeks.
min_ttl
in the global settings sets a minimum TTL for cached records, causing pdnsd to ignore the default TTL in the record received from the server.  On a slow connection or with a slow DNS server, you may want to set this to several hours to reduce the number of lookups (eg
min_ttl=6h;
).
neg_ttl
in the global settings sets a minimum TTL for non-existent domains.  If a server tells pdnsd that a domain does not exist, it will not try to lookup that domain again until this amount of time has elapsed.
Timeouts
Setting shorter timeouts means that pdnsd will give up on an entire query or a given server query more quickly, resulting in faster performance.  The disadvantage to setting timeouts too short is that pdnsd might return an error on a lookup simply because the server was not given enough time to respond.
timeout
in the global settings determines when pdnsd gives up on an entire query and returns an error to your browser or other client. Setting the global timeout option makes it possible to specify quite short timeout intervals in the server sections (see below). This will have the effect that pdnsd will start querying additional servers fairly quickly if the first servers are slow to respond (but will still continue to listen for responses from the first ones). (If you use query_method=tcp_udp it is recommended that you make the global timeout at least twice as large as the largest server timeout, otherwise pdnsd may not have time to try a UDP query if a TCP connection times out.)
tcp_qtimeout
in the global settings determines how long a TCP query connection may be left open.
timeout
in the server settings determines how long pdnsd will wait for a response from each server.  Setting this to a shorter time means that pdnsd will give up on a non-responsive server more quickly and will move on to the next available server, sometimes resulting in a faster overall response time.  On a fast connection, setting this to 4 or 5 seconds is not unreasonable.
Debugging
To see what servers pdnsd is using for a particular lookup, how timeouts are working, and what default TTLs are being used by domains, turn debug on in the global settings:
debug=on;
Restart pdnsd and monitor the pdnsd.service for changes with the
systemd journal
:
# journalctl -f -u pdnsd.service
Be sure to turn debug off for general use as leaving it on may degrade performance.
Cache size
By default, pdnsd will automatically create authoritative records for all entries in
/etc/hosts
. If you have a lot of entries, for example if you are using it for ad blocking, the default maximum cache size provided by
/etc/pdnsd.conf
may not be large enough, resulting in DNS requests not being cached for their expected amount of time.
To increase the cache size, edit the
perm_cache
line in the 'global settings' section of configuration file (size in kB).
Alternatively, you can prevent pdnsd from preemptively sourcing your hosts file by adding the option
authrec=off
to the 'source' section. If, for whatever reason, setting authrec to off does not work, an easy workaround is to create a separate hosts file (eg
/etc/hosts-pdnsd
) with only your system information and point your 'source' section to that instead, while leaving your original hosts file intact. This way, pdnsd will reference
/etc/hosts
only when performing lookups. So for example:
/etc/hosts-pdnsd
#<ip-address>	<hostname.domain.org>	<hostname>
127.0.0.1	localhost.localdomain	my_hostname
::1		localhost.localdomain	localhost
Shared server for your LAN
If you have several computers on your network, you may want to make pdnsd the DNS server for them all. This allows your entire network to share a single DNS cache, making repeated lookups much faster. To allow this, simply set
server_ip
in the
global
section to the name of your network interface (usually
eth0
). If you have set up a firewall, tell it to allow connections to port 53 from any address on your network.
Now you can configure the other computers on your network to use the computer running pdns as their primary dns server.
Name blocking
pdnsd allows you to specify hosts or domains that it should never return results for. This allows you to use it as a primitive ad or content blocker, among other things. Create a new
neg
section in
pdnsd.conf
.
neg
sections have two main options.
name
is the name of the host or domain you want to block.
types
can be set to
domain
to block all hosts in the given domain. The default
pdnsd.conf
gives an example that blocks all ads from doubleclick.net.
Since there can only be one domain set per block, this does not scale well for blocking ads, trackers or malicious content directly in
pdnsd.conf
. You may want to create separate configuration files specifically for these lists, e.g.,
/etc/pdnsd.d/spam_domains
and add an
include
section in
pdnsd.conf
like
include {file="/etc/pdnsd.d/spam_domains";}
Alternatively, it is possible to add a
source
section (additional to the existing one that loads
/etc/hosts
), that loads a file in
/etc/hosts
format that binds domains to the  special IP-Address 0.0.0.0 – but this will not block subdomains since
/etc/hosts
does not allow wildcards. Doing this is equivalent to adding the rules to
/etc/hosts
but it avoids having a huge
/etc/hosts
which can break some applications.
pdnsd-ctl
From
pdnsd-ctl(8) § DESCRIPTION
:
pdnsd-ctl
controls
pdnsd
, a proxy dns server with permanent caching. Note that the status control socket must be enabled (by specifying an option on the pdnsd command line or in the configuration file) before you can use
pdnsd-ctl
.
To do that, include the option
status_ctl = on;
in the global section of the
/etc/pdnsd.conf
.
If you changed the cache directory in
/etc/pdnsd.conf
, you will have to run
pdnsd-ctl
with the
-c
option:
# pdnsd-ctl -c
path/to/cache
A couple of useful commands to get you started...
View cache:
# pdnsd-ctl dump
Flush cache:
# pdnsd-ctl empty-cache
DNSCrypt
pdnsd can be used with
DNSCrypt
. DNSCrypt encrypts the domain name lookup. pdnsd then queries DNSCrypt when necessary. An example configuration is found in
DNSCrypt#pdnsd
.
Troubleshooting
result of uptest for 192.168.x.x: failed
You can successfully ping your ISP's
dynamic DNS
server, even though the log shows the following:
# journalctl -f -u pdnsd.service
result of uptest for 192.168.x.x: failed
Check the interface configured in
/etc/pdnsd.conf
global section exists:
interface = any;
or the one in the server section:
interface=enp2s0;
The correct name can be found by running:
ifconfig
.
FAQs
Q) It does not seem much faster to me. Why?
A)
The extra speed gained from running a local DNS cache is all in how long it takes to connect to a server. Throughput, what people normally think of as speed, will not be affected. The difference is most noticeable when browsing the web, as that typically involves small downloads from several servers. With slower connections, especially dial-up, throughput is the primary bottleneck, so there will not be as large a difference percentage-wise.
Q) Why is it so much slower now than before?
A)
You almost certainly have the
proxy_only
option turned off in one of the server sections of
pdnsd.conf
. By default, pdnsd frequently asks several DNS servers about a domain to get the most accurate response possible. The
proxy_only
option disables this feature. It should be turned on if you use the DNS server provided by your ISP.