Powerdns服务器未传递Authority参数

Question

我已经在服务器上安装了powerdns来处理DNS请求。

设置在端口5300上有powerdns，在端口5301上有recursor，在端口53上有dnsdist。

如果我执行dig，我得到的结果不是权威的，因此被其他名称服务器忽略。

1.在调用递归时：

dig a essyfortunes.com @85.10.203.183

; <<>> DiG 9.16.1-Ubuntu <<>> a essyfortunes.com @85.10.203.183
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64902
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;essyfortunes.com.      IN  A

;; ANSWER SECTION:
essyfortunes.com.   0   IN  A   95.216.38.152

;; Query time: 155 msec
;; SERVER: 85.10.203.183#53(85.10.203.183)
;; WHEN: Tue Jan 19 09:04:44 EAT 2021
;; MSG SIZE  rcvd: 61

1.调用powerdns时：

dig a essyfortunes.com @85.10.203.183 -p 5300

; <<>> DiG 9.16.1-Ubuntu <<>> a essyfortunes.com @85.10.203.183 -p 5300
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19637
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;essyfortunes.com.      IN  A

;; ANSWER SECTION:
essyfortunes.com.   0   IN  A   95.216.38.152

;; Query time: 155 msec
;; SERVER: 85.10.203.183#5300(85.10.203.183)
;; WHEN: Tue Jan 19 09:05:06 EAT 2021
;; MSG SIZE  rcvd: 61

powerdns和recursor都使用默认设置。我的dnsdist设置如下；

setLocal('85.10.203.183')
setACL({'0.0.0.0/0', '::/0'}) -- Allow all IPs access

newServer({address='85.10.203.183:5300', pool='auth'})
newServer({address='85.10.203.183:5301', pool='recursor'})

recursive_ips = newNMG()
recursive_ips:addMask('0.0.0.0/0') -- These network masks are the ones from allow-recursion in the Authoritative Server

addAction(NetmaskGroupRule(recursive_ips), PoolAction('recursor'))
addAction(AllRule(), PoolAction('auth'))

Answer 1

问题是dnsdist设置配置错误。

递归允许的流量应限制在本地subnets.eg 192.168.0.0/16或127.0.0.0/8内

新配置如下图所示；

setLocal('85.10.203.183')
setACL({'0.0.0.0/0', '::/0'}) -- Allow all IPs access

newServer({address='85.10.203.183:5300', pool='auth'})
newServer({address='85.10.203.183:5301', pool='recursor'})

recursive_ips = newNMG()
recursive_ips:addMask('127.0.0.0/8') -- These network masks are the ones from allow-recursion in the Authoritative Server

addAction(NetmaskGroupRule(recursive_ips), PoolAction('recursor'))
addAction(AllRule(), PoolAction('auth'))