Authoritative Server Settings ¶

launch=bind,gmysql,remote
If you find that you need to query a backend multiple times with
different configuration, you can specify a name for later
instantiations. e.g.:
launch=gmysql,gmysql:server2
In this case, there are 2 instances of the gmysql backend, one by the
normal name and the second one is called ‘server2’. The backend
configuration item names change: e.g. gmysql-host is available to
configure the host setting of the first or main instance, and
gmysql-server2-host for the second one.
Running multiple instances of the BIND backend is not allowed.
load-modules¶
Paths, separated by commas
If backends are available in nonstandard directories, specify their
location here. Multiple files can be loaded if separated by commas. Only
available in non-static distributions.
local-address¶
Changed in version 4.3.0: now also accepts IPv6 addresses
Changed in version 4.3.0: Before 4.3.0, this setting only supported IPv4 addresses.
IPv4/IPv6 Addresses, with optional port numbers, separated by commas or whitespace
Default: 0.0.0.0, ::
Local IP addresses to which we bind. Each address specified can
include a port number; if no port is included then the
local-port port will be used for that address. If a
port number is specified, it must be separated from the address with a
‘:’; for an IPv6 address the address must be enclosed in square
brackets.
Examples:
local-address=127.0.0.1 ::1
local-address=0.0.0.0:5353
local-address=[::]:8053
local-address=127.0.0.1:53, [::1]:5353
local-ipv6-nonexist-fail¶
Changed in version 4.3.0: This setting has been removed, use local-address-nonexist-fail
Boolean
Default: no
Fail to start if one or more of the local-ipv6
addresses do not exist on this server.
local-port¶
Integer
Default: 53
Local port to bind to.
If an address in local-address does not have an explicit port, this port is used.
log-dns-details¶
Boolean
Default: no
If set to ‘no’, informative-only DNS details will not even be sent to
syslog, improving performance.
log-dns-queries¶
Boolean
Default: no
Tell PowerDNS to log all incoming DNS queries. This will lead to a lot
of logging! Only enable for debugging! Set loglevel
to at least 5 to see the logs.
log-timestamp¶
Default: yes
When printing log lines to stderr, prefix them with timestamps.
Disable this if the process supervisor timestamps these lines already.
The systemd unit file supplied with the source code already disables timestamp printing
logging-facility¶
If set to a digit, logging is performed under this LOCAL facility. See Logging to syslog.
Do not pass names like ‘local0’!
loglevel¶
Integer
Default: 4
Amount of logging. The higher the number, the more lines logged.
Corresponds to “syslog” level values (e.g. 0 = emergency, 1 = alert, 2 = critical, 3 = error, 4 = warning, 5 = notice, 6 = info, 7 = debug).
Each level includes itself plus the lower levels before it.
Not recommended to set this below 3.
loglevel-show¶
Default: no
New in version 4.9.0.
When enabled, log messages are formatted like structured logs, including their log level/priority: msg="Unable to launch, no backends configured for querying" prio="Error"
lua-axfr-script¶
String
Default: empty
Script to be used to edit incoming AXFRs, see Modifying a secondary zone using a script
lua-consistent-hashes-cleanup-interval¶
Integer
Default: 3600
New in version 4.9.0.
Amount of time (in seconds) between subsequent cleanup routines for pre-computed hashes related to pickchashed().
lua-consistent-hashes-expire-delay¶
Integer
Default: 86400
New in version 4.9.0.
Amount of time (in seconds) a pre-computed hash entry will be considered as expired when unused. See pickchashed().




    

lua-health-checks-expire-delay¶
Integer
Default: 3600
New in version 4.3.0.
Amount of time (in seconds) to expire (remove) a LUA monitoring check when the record
isn’t used any more (either deleted or modified).
lua-health-checks-interval¶
Integer
Default: 5
New in version 4.3.0.
Amount of time (in seconds) between subsequent monitoring health checks. Does nothing
if the checks take more than that time to execute.
lua-prequery-script¶
Lua script to run before answering a query. This is a feature used
internally for regression testing. The API of this functionality is not
guaranteed to be stable, and is in fact likely to change.
lua-records-exec-limit¶
Integer
Default: 1000
Limit LUA records scripts to lua-records-exec-limit instructions.
Setting this to any value less than or equal to 0 will set no limit.
lua-records-insert-whitespace¶
Boolean
Default: no in 5.0, yes before that
New in version 4.9.1.
When combining the " delimited chunks of a LUA record, whether to insert whitespace between each chunk.
master¶
Deprecated since version 4.5.0: Renamed to primary.
Boolean
Default: no
Turn on master support. See Primary operation.
max-cache-entries¶
Integer
Default: 1000000
Maximum number of entries in the query cache. 1 million (the default)
will generally suffice for most installations.
max-ent-entries¶
Integer
Default: 100000
Maximum number of empty non-terminals to add to a zone. This is a
protection measure to avoid database explosion due to long names.
max-include-depth¶
Integer
Default: 20
Maximum number of nested $INCLUDE directives while processing a zone file.
Zero mean no $INCLUDE directives will be accepted.
max-generate-steps¶
Integer
Default: 0
Maximum number of steps for a ‘$GENERATE’ directive when parsing a
zone file. This is a protection measure to prevent consuming a lot of
CPU and memory when untrusted zones are loaded. Default to 0 which
means unlimited.
max-nsec3-iterations¶
Integer
Default: 100
Limit the number of NSEC3 hash iterations for zone configurations.
For more information see Setting the NSEC modes and parameters.
Pre 4.5.0 the default was 500.
max-packet-cache-entries¶
Integer
Default: 1000000
Maximum number of entries in the packet cache. 1 million (the default)
will generally suffice for most installations.
max-queue-length¶
Integer
Default: 5000
If this many packets are waiting for database attention, consider the
situation hopeless and respawn.
max-signature-cache-entries¶
Integer
Default: 2^31-1 (on most systems), 2^63-1 (on ILP64 systems)
Maximum number of DNSSEC signature cache entries. This cache is
automatically reset once per week or when the cache is full. If you
use NSEC narrow mode, this cache can grow large.
max-tcp-connection-duration¶
Integer
Default: 0
Maximum time in seconds that a TCP DNS connection is allowed to stay
open. 0 means unlimited. Note that exchanges related to an AXFR or IXFR
are not affected by this setting.
max-tcp-connections¶
Integer
Default: 20
Allow this many incoming TCP DNS connections simultaneously.
max-tcp-connections-per-client¶
Integer
Default: 0
Maximum number of simultaneous TCP connections per client. 0 means
unlimited.
max-tcp-transactions-per-conn¶
Integer
Default: 0
Allow this many DNS queries in a single TCP transaction. 0 means
unlimited. Note that exchanges related to an AXFR or IXFR are not
affected by this setting.
module-dir¶
Directory for modules. Default depends on PKGLIBDIR during
compile-time.
negquery-cache-ttl¶
Integer
Default: 60
Seconds to store queries with no answer in the Query Cache. See Query Cache.
no-config¶
Boolean
Default: no
Do not attempt to read the configuration file. Useful for configuration
by parameters from the command line only.
no-shuffle¶
Boolean
Default: no
Do not attempt to shuffle query results, used for regression testing.
non-local-bind¶
Boolean
Default: no
Bind to addresses even if one or more of the
local-address’s do not exist on this server.
Setting this option will enable the needed socket options to allow
binding to non-local addresses. This feature is intended to facilitate
ip-failover setups, but it may also mask configuration issues and for
this reason it is disabled by default.
only-notify¶
IP Ranges, separated by commas or whitespace
Default: 0.0.0.0/0, ::/0
For type=MASTER zones (or SLAVE zones with slave-renotify enabled)
PowerDNS automatically sends NOTIFYs to the name servers specified in
the NS records. By specifying networks/mask as whitelist, the targets
can be limited. The default is to notify the world. To completely
disable these NOTIFYs set only-notify to an empty value. Independent
of this setting, the IP addresses or netmasks configured with
also-notify and ALSO-NOTIFY zone metadata
always receive AXFR NOTIFYs.
IP addresses and netmasks can be excluded by prefixing them with a !.
To notify all IP addresses apart from the 192.168.0.0/24 subnet use the following:
only-notify=0.0.0.0/0, ::/0, !192.168.0.0/24
Even if NOTIFYs are limited by a netmask, PowerDNS first has to
resolve all the hostnames to check their IP addresses against the
specified whitelist. The resolving may take considerable time,
especially if those hostnames are slow to resolve. If you do not need to
NOTIFY the slaves defined in the NS records (e.g. you are using another
method to distribute the zone data to the slaves), then set
only-notify to an empty value and specify the notification targets
explicitly using also-notify and/or
ALSO-NOTIFY zone metadata to avoid this potential bottleneck.
If your slaves support an Internet Protocol version, which your master does not,
then set only-notify to include only supported protocol version.
Otherwise there will be error trying to resolve address.
For example, slaves support both IPv4 and IPv6, but PowerDNS master have only IPv4,
so allow only IPv4 with only-notify:
only-notify=0.0.0.0/0
Changed in version 4.9.0: Option ignore-errors added.
If this is enabled, ALIAS records are expanded (synthesized to their
A/AAAA) during outgoing AXFR. This means slaves will not automatically
follow changes in those A/AAAA records unless you AXFR regularly!
If this is disabled (the default), ALIAS records are sent verbatim
during outgoing AXFR. Note that if your slaves do not support ALIAS,
they will return NODATA for A/AAAA queries for such names.
If the ALIAS target cannot be resolved during AXFR the AXFR will fail.
To allow outgoing AXFR also if the ALIAS targets are broken set this
setting to ignore-errors.
Be warned, this will lead to inconsistent zones between Primary and
Secondary name servers.
overload-queue-length¶
Integer
Default: 0 (disabled)
If this many packets are waiting for database attention, answer any new
questions strictly from the packet cache. Packets not in the cache will
be dropped, and _stat-overload-drops will be incremented.
prevent-self-notification¶
Boolean
Default: yes
PowerDNS Authoritative Server attempts to not send out notifications to
itself in master mode. In very complicated situations we could guess
wrong and not notify a server that should be notified. In that case, set
prevent-self-notification to “no”.
primary¶
Changed in version 4.5.0: This was called master before 4.5.0.
Boolean
Default: no
Turn on operating as a primary. See Primary operation.
proxy-protocol-from¶
New in version 4.6.0.
IP addresses or netmasks, separated by commas
Default: empty
Ranges that are required to send a Proxy Protocol version 2 header in front of UDP and TCP queries, to pass the original source and destination addresses and ports to the Authoritative.
Queries that are not prefixed with such a header will not be accepted from clients in these ranges. Queries prefixed by headers from clients that are not listed in these ranges will be dropped.
Note that once a Proxy Protocol header has been received, the source address from the proxy header instead of the address of the proxy will be checked against primary addresses sending NOTIFYs, and the ACLs for any client requesting AXFRs.
When using this setting combined with trusted-notification-proxy, please be aware that the trusted address will also be checked against the source address in the PROXY header.
The dnsdist docs have more information about the PROXY protocol.
proxy-protocol-maximum-size¶
New in version 4.6.0.
Integer
Default: 512
The maximum size, in bytes, of a Proxy Protocol payload (header, addresses and ports, and TLV values). Queries with a larger payload will be dropped.
query-cache-ttl¶
Integer
Default: 20
Seconds to store queries with an answer in the Query Cache. See Query Cache.
query-local-address¶
Changed in version 4.4.0: Accepts both IPv4 and IPv6 addresses. Also accept more than one address per
address family.




    

IP addresses, separated by spaces or commas
Default: 0.0.0.0 ::
The IP addresses to use as a source address for sending queries. Useful if
you have multiple IPs and PowerDNS is not bound to the IP address your
operating system uses by default for outgoing packets.
PowerDNS will pick the correct address family based on the remote’s address (v4
for outgoing v4, v6 for outgoing v6). However, addresses are selected at random
without taking into account ip subnet reachability. It is highly recommended to
use the defaults in that case (the kernel will pick the right source address for
the network).
query-local-address6¶
Deprecated since version 4.5.0: Removed. Use query-local-address.
query-logging¶
Boolean
Default: no
Boolean, hints to a backend that it should log a textual representation
of queries it performs. Can be set at runtime.
queue-limit¶
Integer
Default: 1500
Maximum number of milliseconds to queue a query. See Performance and Tuning.
receiver-threads¶
Integer
Default: 1
Number of receiver (listening) threads to start. See Performance and Tuning.
resolver¶
IP Address with optional port
Default: unset
Recursive DNS server to use for ALIAS lookups and the internal stub resolver. Only one address can be given.
Examples:
resolver=127.0.0.1
resolver=[::1]:5300
On Linux 3.9 and some BSD kernels the SO_REUSEPORT option allows
each receiver-thread to open a new socket on the same port which allows
for much higher performance on multi-core boxes. Setting this option
will enable use of SO_REUSEPORT when available and seamlessly fall
back to a single socket when it is not available. A side-effect is that
you can start multiple servers on the same IP/port combination which may
or may not be a good idea. You could use this to enable transparent
restarts, but it may also mask configuration issues and for this reason
it is disabled by default.
rng¶
String
Default: auto
Specify which random number generator to use. Permissible choices are:
auto - choose automatically
sodium - Use libsodium randombytes_uniform
openssl - Use libcrypto RAND_bytes
getrandom - Use libc getrandom, falls back to urandom if it does not really work
arc4random - Use BSD arc4random_uniform
urandom - Use /dev/urandom
kiss - Use simple settable deterministic RNG. FOR TESTING PURPOSES ONLY!
Not all choices are available on all systems.
secondary¶
Changed in version 4.5.0: This was called slave before 4.5.0.
Boolean
Default: no
Turn on operating as a secondary. See Secondary operation.
secondary-do-renotify¶
Changed in version 4.5.0: This was called slave-renotify before 4.5.0.
Boolean
Default: no
This setting will make PowerDNS renotify the secondaries after an AXFR is
received from a primary. This is useful, among other situations, when running a
signing secondary.
See SLAVE-RENOTIFY to set this per-zone.
security-poll-suffix¶
String
Default: secpoll.powerdns.com.
Zone name from which to query security update notifications. Setting
this to an empty string disables secpoll.
send-signed-notify¶
Boolean
Default: yes
If yes, outgoing NOTIFYs will be signed if a TSIG key is configured for the zone.
If there are multiple TSIG keys configured for a zone, PowerDNS will use the
first one retrieved from the backend, which may not be the correct one for the
respective slave. Hence, in setups with multiple slaves with different TSIG keys
it may be required to send NOTIFYs unsigned.
server-id¶
String
Default: The hostname of the server
This is the server ID that will be returned on an EDNS NSID query.
setgid¶
String
If set, change group id to this gid for more security. See Security of PowerDNS.
setuid¶
String
If set, change user id to this uid for more security. See Security of PowerDNS.
signing-threads¶
Integer
Default: 3
Tell PowerDNS how many threads to use for signing. It might help improve
signing speed by changing this number.
slave¶
Deprecated since version 4.5.0: Renamed to secondary.
slave-cycle-interval¶
Deprecated since version 4.5.0: Renamed to xfr-cycle-interval.
slave-renotify¶
Deprecated since version 4.5.0: Renamed to secondary-do-renotify.
Boolean
Default: no
This setting will make PowerDNS renotify the slaves after an AXFR is
received from a master. This is useful when running a
signing-slave.
See SLAVE-RENOTIFY to set this per-zone.
soa-expire-default¶
Integer
Default: 604800
Deprecated since version 4.2.0: This setting has been removed in 4.4.0
Default SOA expire.
soa-minimum-ttl¶
Integer
Default: 3600
Deprecated since version 4.2.0: This setting has been removed in 4.4.0
Default SOA minimum ttl.
soa-refresh-default¶
Integer
Default: 10800
Deprecated since version 4.2.0: This setting has been removed in 4.4.0
Default SOA refresh.
soa-retry-default¶
Integer
Default: 3600
Deprecated since version 4.2.0: This setting has been removed in 4.4.0
Default SOA retry.
socket-dir¶
Where the controlsocket will live. The default depends on
LOCALSTATEDIR during compile-time (usually /var/run or
/run). See Control Socket.
This path will also contain the pidfile for this instance of PowerDNS
called pdns.pid by default. See config-name
and Virtual Hosting how this can differ.
superslave¶
Deprecated since version 4.5.0: Renamed to autosecondary.
Boolean
Default: no
Turn on supermaster support. See Autoprimary: automatic provisioning of secondaries.
svc-autohints¶
Boolean
Default: no
New in version 4.5.0.
Whether or not to enable IPv4 and IPv6 autohints.
tcp-control-address¶
IP Address
Address to bind to for TCP control.
tcp-control-port¶
Integer
Default: 53000
Port to bind to for TCP control.
tcp-control-range¶
IP Ranges, separated by commas or whitespace
Limit TCP control to a specific client range.
tcp-control-secret¶
String
Password for TCP control.
tcp-fast-open¶
Integer
Default: 0 (Disabled)
Enable TCP Fast Open support, if available, on the listening sockets.
The numerical value supplied is used as the queue size, 0 meaning
disabled.
tcp-idle-timeout¶
Integer
Default: 5
Maximum time in seconds that a TCP DNS connection is allowed to stay
open while being idle, meaning without PowerDNS receiving or sending
even a single byte.
traceback-handler¶
Boolean
Default: yes
Enable the Linux-only traceback handler.
trusted-notification-proxy¶
Changed in version 4.4.0: This option now accepts a comma-separated list of IP ranges. This was a list of IP addresses before.
IP ranges, separated by commas
IP ranges of incoming notification proxies.
udp-truncation-threshold¶
Integer
Default: 1232
EDNS0 allows for large UDP response datagrams, which can potentially
raise performance. Large responses however also have downsides in terms
of reflection attacks. Maximum value is 65535, but values above
4096 should probably not be attempted.
Why 1232?
1232 is the largest number of payload bytes that can fit in the smallest IPv6 packet.
IPv6 has a minimum MTU of 1280 bytes (RFC 8200, section 5), minus 40 bytes for the IPv6 header, minus 8 bytes for the UDP header gives 1232, the maximum payload size for the DNS response.
upgrade-unknown-types¶
Boolean
Default: no
New in version 4.4.0.
Transparently upgrade records stored as TYPE#xxx and RFC 3597 (hex format)
contents, if the type is natively supported.
When this is disabled, records stored in this format cannot be served.
Recommendation: keep disabled for better performance.
Enable for testing PowerDNS upgrades, without changing stored records.
Enable for upgrading record content on secondaries, or when using the API (see upgrade notes).
Disable after record contents have been upgraded.
This option is supported by the bind and Generic SQL backends.
When using a generic SQL backend, records with an unknown record type (see Supported Record Types) can be identified with the following SQL query:
SELECT * from records where type like 'TYPE%';
When queried for its version over DNS
(dig chaos txt version.bind @pdns.ip.address), PowerDNS normally
responds truthfully. With this setting you can overrule what will be
returned. Set the version-string to full to get the default
behaviour, to powerdns to just make it state
Served by PowerDNS - https://www.powerdns.com/. The anonymous
setting will return a ServFail, much like Microsoft nameservers do. You
can set this response to a custom value as well.
webserver¶
Boolean
Default: no
Start a webserver for monitoring. See Performance and Tuning”.
webserver-address¶
IP Address
Default: 127.0.0.1
IP Address for webserver/API to listen on.
webserver-allow-from¶
IP ranges, separated by commas or whitespace
Default: 127.0.0.1,::1
Webserver/API access is only allowed from these subnets.
webserver-hash-plaintext-credentials¶
New in version 4.6.0.
Boolean
Default: no
Whether passwords and API keys supplied in the configuration as plaintext should be hashed during startup, to prevent the plaintext versions from staying in memory. Doing so increases significantly the cost of verifying credentials and is thus disabled by default.
Note that this option only applies to credentials stored in the configuration as plaintext, but hashed credentials are supported without enabling this option.
webserver-loglevel¶
String, one of “none”, “normal”, “detailed”
Default: normal
The amount of logging the webserver must do. “none” means no useful webserver information will be logged.
When set to “normal”, the webserver will log a line per request that should be familiar:
[webserver] e235780e-a5cf-415e-9326-9d33383e739e 127.0.0.1:55376 "GET /api/v1/servers/localhost/bla HTTP/1.1" 404 196
When set to “detailed”, all information about the request and response are logged:
[webserver] e235780e-a5cf-415e-9326-9d33383e739e Request Details:
[webserver] e235780e-a5cf-415e-9326-9d33383e739e  Headers:
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   accept-encoding: gzip, deflate
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   accept-language: en-US,en;q=0.5
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   connection: keep-alive
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   dnt: 1
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   host: 127.0.0.1:8081
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   upgrade-insecure-requests: 1
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
[webserver] e235780e-a5cf-415e-9326-9d33383e739e  No body
[webserver] e235780e-a5cf-415e-9326-9d33383e739e Response details:
[webserver] e235780e-a5cf-415e-9326-9d33383e739e  Headers:
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   Connection: close
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   Content-Length: 49
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   Content-Type: text/html; charset=utf-8
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   Server: PowerDNS/0.0.15896.0.gaba8bab3ab
[webserver] e235780e-a5cf-415e-9326-9d33383e739e  Full body:
[webserver] e235780e-a5cf-415e-9326-9d33383e739e   <!html><title>Not Found</title><h1>Not Found</h1>
[webserver] e235780e-a5cf-415e-9326-9d33383e739e 127.0.0.1:55376 "GET /api/v1/servers/localhost/bla HTTP/1.1" 404 196
The value between the hooks is a UUID that is generated for each request. This can be used to find all lines related to a single request.
The webserver logs these line on the NOTICE level. The loglevel seting must be 5 or higher for these lines to end up in the log.
webserver-max-bodysize¶
Integer
Default: 2
Maximum request/response body size in megabytes.
webserver-password¶
Changed in version 4.6.0: This setting now accepts a hashed and salted version.
String
Password required to access the webserver. Since 4.6.0 the password can be hashed and salted using pdnsutil hash-password instead of being present in the configuration in plaintext, but the plaintext version is still supported.
webserver-port¶
Integer
Default: 8081
The port where webserver/API will listen on.
webserver-print-arguments¶
Boolean
Default: no
If the webserver should print arguments.
write-pid¶
Boolean
Default: yes
If a PID file should be written.
workaround-11804¶
Boolean
Default: no
Workaround for issue #11804 (outgoing AXFR may try to overfill a chunk and fail).
Default of no implies the pre-4.8 behaviour of up to 100 RRs per AXFR chunk.
If enabled, only a single RR will be put into each AXFR chunk, making some zones transferable when they were not.
xfr-cycle-interval¶
Changed in version 4.5.0: This was called slave-cycle-interval before 4.5.0.
Integer
Default: 60
On a primary, this is the amount of seconds between the primary checking
the SOA serials in its database to determine to send out NOTIFYs to the
secondaries. On secondaries, this is the number of seconds between the secondary
checking for updates to zones.
xfr-max-received-mbytes¶
Integer
Default: 100
Specifies the maximum number of received megabytes allowed on an
incoming AXFR/IXFR update, to prevent resource exhaustion. A value of 0
means no restriction.
zone-cache-refresh-interval¶
Integer
Default: 300
Seconds to cache a list of all known zones. A value of 0 will disable the cache.
If your backends do not respond to unknown or dynamically generated zones, it is suggested to enable consistent-backends (default since 4.5) and leave this option at its default of 300.
zone-metadata-cache-ttl¶
Changed in version 4.5.0: This was called domain-metadata-cache-ttl before 4.5.0.
Integer
Default: 60
Seconds to cache zone metadata from the database. A value of 0
disables caching.