Re: DNSSEC + Split DNS
Brian Candler via Pdns-users <[email protected]> Thu, 9 Apr 2026 10:47:34 +0100
| Newsgroups | gmane.network.dns.powerdns.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============1663639994606780534==
Content-Type: multipart/alternative;
boundary="------------OxMrlgxNvIiaxnKGIDrYzBfn"
Content-Language: en-GB
This is a multi-part message in MIME format.
--------------OxMrlgxNvIiaxnKGIDrYzBfn
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
On 09/04/2026 10:24, rob777 via Pdns-users wrote:
>
> Response Policy Zone on the recursor is the way I'd do it. This is
> what RPZ is designed for: to override specific DNS answers.
>
> I've used to do it with Bind Views in the past as i've had BIND
> running. As i've migrated to Powerdns this generated some issues
> obviously since bind view wasnt available then and it has to be done
> with LUA Records.
>
> This historical thing with Shadow Records is something that is
> difficult to clean up and fix for different reasons. And it
> regularly comes back and bites me in the ass..
RPZs are the "standard" mechanism for this; people use it for things
like ad and porn blocking, but really it does exactly what you need.
PowerDNS has had it for ten years:
https://blog.powerdns.com/2016/06/28/response-policy-zone-support-in-powerdns-recursor
Example YAML config:
recursor:
rpzs:
- name: /etc/powerdns/rpz.zone
# content of file /etc/powerdns/rpz.zone
$TTL 300
@ IN SOA localhost. root.localhost. (
2026040900 60 60 43200 60
)
IN NS localhost.
www.powerdns.com A 1.2.3.4
# Testing:
dig @localhost www.powerdns.com. a
...
;; ANSWER SECTION:
www.powerdns.com. 268 IN A 1.2.3.4
It's as simple as that. In this single zone, you list all the records
you want to override, as subdomains of the policy zone (hence no dot
after "www.powerdns.com" in the example above).
If you wish, you can make the RPZ a real DNS zone under a domain you
control (e.g. rpz.test.com) and then the recursor(s) can fetch it using
AXFR. Then you can manage it using whatever tools you use normally to
manage zone contents, and multiple recursors can fetch the same zone.
The above example bypasses this by using a local file.
There are other actions you put in RPZs to manipulate the responses: for
example a "CNAME ." record will give an NXDOMAIN response. Docs aren't
hard to find.
Regards,
Brian.
--------------OxMrlgxNvIiaxnKGIDrYzBfn
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 09/04/2026 10:24, rob777 via
Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAAPVCxy-9HXLV0CrBD6UqrpFzt_bntgEN7h07KyqSOvXwicLTA@mail.gmail.com">
<blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Response Policy Zone on the recursor is the way I'd do it.
This is what RPZ is designed for: to override specific DNS
answers.</p>
</div>
</blockquote>
<div> </div>
<div>I've used to do it with Bind Views in the past as i've had
BIND running. As i've migrated to Powerdns this generated some
issues obviously since bind view wasnt available then and it has
to be done with LUA Records.</div>
<div><br>
</div>
<div>This historical thing with Shadow Records is something that
is difficult to clean up and fix for different reasons. And it
regularly comes back and bites me in the ass..</div>
</blockquote>
<p>RPZs are the "standard" mechanism for this; people use it for
things like ad and porn blocking, but really it does exactly what
you need. PowerDNS has had it for ten years:
<a class="moz-txt-link-freetext" href="https://blog.powerdns.com/2016/06/28/response-policy-zone-support-in-powerdns-recursor">https://blog.powerdns.com/2016/06/28/response-policy-zone-support-in-powerdns-recursor</a></p>
<p>Example YAML config:</p>
<p><font face="monospace">recursor:<br>
rpzs:<br>
- name: /etc/powerdns/rpz.zone</font></p>
<p># content of file /etc/powerdns/rpz.zone</p>
<p><font face="monospace">$TTL 300<br>
@ IN SOA localhost. root.localhost. (<br>
2026040900 60 60 43200 60<br>
)<br>
IN NS localhost.<br>
<a class="moz-txt-link-abbreviated" href="http://www.powerdns.com">www.powerdns.com</a> A 1.2.3.4</font></p>
<p># Testing:</p>
<p><font face="monospace">dig @localhost <a class="moz-txt-link-abbreviated" href="http://www.powerdns.com">www.powerdns.com</a>. a<br>
<br>
...<br>
<br>
;; ANSWER SECTION:<br>
<a class="moz-txt-link-abbreviated" href="http://www.powerdns.com">www.powerdns.com</a>. 268 IN A 1.2.3.4</font><br>
</p>
<p>It's as simple as that. In this single zone, you list all the
records you want to override, as subdomains of the policy zone
(hence no dot after "<a class="moz-txt-link-abbreviated" href="http://www.powerdns.com">www.powerdns.com</a>" in the example above).</p>
<p>If you wish, you can make the RPZ a real DNS zone under a domain
you control (e.g. rpz.test.com) and then the recursor(s) can fetch
it using AXFR. Then you can manage it using whatever tools you use
normally to manage zone contents, and multiple recursors can fetch
the same zone. The above example bypasses this by using a local
file.</p>
<p>There are other actions you put in RPZs to manipulate the
responses: for example a "CNAME ." record will give an NXDOMAIN
response. Docs aren't hard to find.</p>
<p>Regards,</p>
<p>Brian.</p>
</body>
</html>
--------------OxMrlgxNvIiaxnKGIDrYzBfn--
--===============1663639994606780534==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Pdns-users mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-users
--===============1663639994606780534==--