Re: forward zone VS rpz with recursor?
Brian Candler via Pdns-users <[email protected]> Thu, 12 Feb 2026 08:08:27 +0000
| Newsgroups | gmane.network.dns.powerdns.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============0088824875150770393==
Content-Type: multipart/alternative;
boundary="------------L220PXctMbp055Wg47devAkt"
Content-Language: en-GB
This is a multi-part message in MIME format.
--------------L220PXctMbp055Wg47devAkt
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
On 12/02/2026 06:19, listy via Pdns-users wrote:
> Seems that in my 'traditional' forward zones config file I was missing
> the '+'
>
> +forwarded.zone=9.9.9.9,8.8.4.4
>
> then yes, public recursors work - otherwise NS for those domains are
> needed (as a side-note to beginner like myself)
The issue is that you need to set the "Recursion Desired" (RD) bit on
requests which are going to recursive servers. It must not be set on
requests which are sent to authoritative servers.
It's not really a case of NS records being required. An authoritative
server will typically have NS records pointing at it (so that it can be
found), but it's not necessary to function. You could, for example, set
up a standalone authoritative server for a hidden zone, and forward
requests to it from the recursor.
If the zone above is DNSSEC signed, but the hidden zone is not, that's
when a Negative Trust Anchor (NTA)
<https://doc.powerdns.com/recursor/lua-config/dnssec.html> is also required.
--------------L220PXctMbp055Wg47devAkt
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 12/02/2026 06:19, listy via
Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:[email protected]">Seems
that in my 'traditional' forward zones config file I was missing
the '+'
<br>
<br>
+forwarded.zone=9.9.9.9,8.8.4.4
<br>
<br>
then yes, public recursors work - otherwise NS for those domains
are needed (as a side-note to beginner like myself)
</blockquote>
<br>
<p>The issue is that you need to set the "Recursion Desired" (RD)
bit on requests which are going to recursive servers. It must not
be set on requests which are sent to authoritative servers.</p>
<p>It's not really a case of NS records being required. An
authoritative server will typically have NS records pointing at it
(so that it can be found), but it's not necessary to function. You
could, for example, set up a standalone authoritative server for a
hidden zone, and forward requests to it from the recursor.</p>
<p>If the zone above is DNSSEC signed, but the hidden zone is not,
that's when a <a moz-do-not-send="true"
href="https://doc.powerdns.com/recursor/lua-config/dnssec.html">Negative
Trust Anchor (NTA)</a> is also required.</p>
</body>
</html>
--------------L220PXctMbp055Wg47devAkt--
--===============0088824875150770393==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Pdns-users mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-users
--===============0088824875150770393==--