PowerDNS

PowerDNS
is a DNS server, written in C++ and licensed under the GPL. PowerDNS features a large number of different backends ranging from simple
BIND
style zonefiles to relational databases and load balancing/failover algorithms.
Installation
Install
the
powerdns
package.
Next you can review the configuration file located at
/etc/powerdns/pdns.conf
.
Backends
To configure PowerDNS to use specific backend you will need to set the
launch
option in configuration file.
Also depending on particular backend you use, you will have to configure it.
For
PostgreSQL
,
MySQL
and
SQLite
you can find database table creation SQL files located at
/usr/share/doc/powerdns
.
PostgreSQL backend
Firstly you will need to
create a user and database
where PowerDNS can store data, then import the schema:
$ psql -U <user> -d <database name> -a -f /usr/share/doc/powerdns/schema.pgsql.sql
And finally update configuration file to use the backend:
/etc/powerdns/pdns.conf
launch=gpgsql
gpgsql-host=/run/postgresql # if PostgreSQL is listening to unix socket
# gpgsql-host=127.0.0.1
# gpgsql-port=5432
gpgsql-dbname=<database name>
gpgsql-user=<user to use>
gpgsql-password=
# Uncomment for dnssec support
#gpgsql-dnssec=yes
MySQL backend
Install and run a
MySQL
server. Create a new user, and a new database and import the schema into the db:
$ mysql -u root -p pdns < /usr/share/doc/powerdns/schema.mysql.sql
Then, configure Powerdns to use MySQL:
/etc/powerdns/pdns.conf
launch=gmysql
gmysql-host=127.0.0.1
gmysql-socket=/run/mysqld/mysqld.sock
gmysql-user=pdns
gmysql-password=Pa$$w0rd
gmysql-dbname=pdns
# Uncomment for dnssec support
#gmysql-dnssec=yes
You could also use localhost instead of 127.0.0.1, but this causes PowerDNS to use the socket file. As PowerDNS runs in a chroot by default, the socket file is not available.
SQLite backend
Configure Powerdns to use sqlite:
/etc/powerdns/pdns.conf
launch=gsqlite3
gsqlite3-database=/var/lib/powerdns/pdns.sqlite3
# Uncomment for dnssec support
#gsqlite3-dnssec=yes
Create the database:
# mkdir /var/lib/powerdns
# sqlite3 /var/lib/powerdns/pdns.sqlite3 < /usr/share/doc/powerdns/schema.sqlite3.sql
# chown -R powerdns:powerdns /var/lib/powerdns
Startup
Start/enable
pdns.service
.
Zone management
PowerDNS comes with
pdnsutil(1)
utility to easily manage hosted zones.
Create a new, empty zone:
[powerdns]$ pdnsutil create-zone example.net
To edit the zone:
[powerdns]$ pdnsutil edit-zone example.net
Note
EDITOR
environment variable
must be set to be able edit the zone this way.
Warning
When editing the zone, all names
must
be in fully-qualified form, without trailing dot (e.g.
www.example.net
).
Upon saving and quitting the editor, you will be asked for confirmation to commit the changes.
Carefully read the shown diff
and only press
a
when you're certain that the change is correct. If you keep SOA record unchanged, you'll also be asked whether to increase serial number or not. In most cases, you can simply reply with
y
, which bumps the number.
When you want to no longer serve the zone, you can remove it from the backend:
[powerdns]$ pdnsutil delete-zone example.net
DNSSEC
PowerDNS has easy-to-use facilities to serve DNSSEC-signed zone with minimal administrative overhead. It takes advantage of
online signing architecture
, which generates signatures on-demand when queries come from Internet.
For most cases, turning existing insecure zone into DNSSEC-signed one is as simply as:
[powerdns]$ pdnsutil secure-zone example.net
This will sign the zone with single (CSK) ECDSA 256-bit (algorithm 13) key with NSEC denial-of-existence.
For more flexibility on key generation,
pdnsutil add-zone-key
command can be used instead. For example, to generate traditional KSK/ZSK split ECDSA 256-bit keys:
[powerdns]$ pdnsutil add-zone-key example.net ksk active published ecdsa256
[powerdns]$ pdnsutil add-zone-key example.net zsk active published ecdsa256
[powerdns]$ pdnsutil increase-serial example.net
To view DS records (and other zone information):
[powerdns]$ pdnsutil show-zone example.dns
Submit DS to the parent zone (e.g. by filling the web form on your registrar).
Note
In
primary/secondary setup
, DNSSEC-signed zones are served as pre-signed zones on secondaries. This can alleviate CPU load on secondaries as these zones' signatures were generated in online signing mode on primary (which can be set up as stealth one) during zone transfer.
Warning
PowerDNS currently doesn't have automatic key management feature. If you want to roll keys, see the upstream guide (
for KSK
,
for ZSK
, and
for algorithm rollovers
) to avoid pitfalls that can cause your zone being bogus.
Tips and tricks
Bind address and/or port
The default
/etc/powerdns/pdns.conf
binds to 0.0.0.0:53 (all IP addresses). This will conflict with any other process bound to port 53, for example
systemd-resolved
uses 127.0.0.53:53. This will result in an error:
Unable to bind UDP socket to '0.0.0.0:53': Address already in use
This can be resolved in a number of ways, for example changing either/both
local-address
or
local-port
options:
/etc/powerdns/pdns.conf
local-address=127.0.0.1:54
Zone replication via AXFR (primary/secondary setup)
By default, zones in PowerDNS are
native
, which means that zone replication is handled by the backend. It is only make sense for MySQL and PostgreSQL backends as they have database replication facility.
You can also configure PowerDNS in classical primary/secondary setup. First, enable appropriate mode in
/etc/powerdns/pdns.conf
.
On primary:
/etc/powerdns/pdns.conf
primary=yes
allow-axfr-ips=
10.20.30.50
/32
On secondary:
/etc/powerdns/pdns.conf
secondary=yes
allow-notify-from=
10.20.30.40
/32
where
10.20.30.40
and
10.20.30.50
are IP addresses of primary and secondary, respectively.
Restart
pdns.service
.
Set the zone type on primary as primary zone:
[powerdns]$ pdnsutil set-kind example.net primary
On secondary, create the secondary zone, specifying primary's IP address to retrieve from:
[powerdns]$ pdnsutil create-secondary-zone example.net
10.20.30.40
The zone will be transferred after a while.
TSIG authentication
You can also authenticate zone transfers with TSIG keys.
On primary, generate hmac-sha256 key:
[powerdns]$ pdnsutil generate-tsig-key example hmac-sha256
Create new TSIG key example
<secret>
Enable the key for primary zone's outgoing transfer:
[powerdns]$ pdnsutil activate-tsig-key example.net example primary
On secondary, import the key:
[powerdns]$ pdnsutil import-tsig-key example hmac-sha256 '<secret>'
Enable the key for secondary zone's transfer request:
[powerdns]$ pdnsutil activate-tsig-key example.net example secondary
See also
PowerDNS manual