Learning DNS - Pre-Requisite Skills & Environment Setup

#Introduction

Welcome to the Learning DNS series! This series will take you on a journey to master DNS with the PowerDNS stack: PowerDNS Authoritative Server for answering queries on your own zones, PowerDNS Recursor for finding answers on behalf of your clients, and dnsdist as the load balancer and front door with DoT, DoH, and DoQ support. There are 23 episodes in total, arranged across six phases.

Before we touch PowerDNS, there are some basic skills and software you must have. DNS is not just "looking up a domain name." It is a decades-old network protocol that runs on port 53, uses both UDP and TCP, and hides hundreds of record types plus intricate security mechanisms inside. Without a solid foundation in networking and Linux, PowerDNS configuration will feel like a black box.

This Episode 0 is your roadmap: we'll make sure you have the basic skills, set up a VM or Docker lab, add the official PowerDNS repositories, install the trio of daemons, and perform your first verification with dig. Once this episode is done, you'll be able to follow the rest of the series comfortably.

#Essential Basic Skills

#Basic Networking

DNS lives on top of networks, so you must understand IP addressing and subnetting. You should be able to read CIDR notation like 192.0.2.0/24, understand the loopback address 127.0.0.1, and know how to inspect an interface's IP address.

Just as important is the difference between TCP vs UDP. Normal DNS queries run over UDP port 53 because it's fast and cheap. However, zone transfers (AXFR/IXFR) and large responses use TCP port 53. You should also understand service ports, because PowerDNS Authoritative, Recursor, and dnsdist can each listen on port 53 with different roles.

ip addr show
ip route show

#Linux Operations

PowerDNS is a daemon managed by systemd. You must be comfortable running systemctl, checking service status, enabling services at boot, and reading logs with journalctl. If your lab uses a firewall like ufw or firewalld, make sure you can open ports 53 and 853.

journalctl -u pdns -f
systemctl status pdns

#Command Line Habits

Throughout the series you'll live with dig, nslookup, ping, and tcpdump. dig is the Swiss army knife of DNS: you can specify the query server, record type, and debug flags. nslookup is simpler and still used by many teams. We'll cover both in depth in episode 8.

resolvectl status
resolvectl query google.com

#Software to Prepare

#VM or Docker Lab

You'll need two to three Linux instances. An ideal combination: one instance as primary authoritative, one as secondary, and one as a recursor serving clients. The distribution is up to you, for example Ubuntu 24.04, Debian 12, or Rocky Linux 9. If resources are limited, Docker can replace VMs, but running three containers on a single host will slightly reduce the fidelity of your network simulation.

docker --version
uname -a

#PowerDNS Packages

The packages we install come from the official repo.powerdns.com repository, not from the distribution's repositories, so the versions stay current and consistent. Target versions at the time this series was written: PowerDNS Authoritative 5.1.3, PowerDNS Recursor 5.4.4, and dnsdist 2.1.0. These three daemons can be installed on one machine for learning, but in production they should be separated.

#Adding the Official PowerDNS Repository

#Debian / Ubuntu

The first step is to add the PowerDNS GPG key and write the source list. The distribution in this example is noble (Ubuntu 24.04), and we register three repositories: auth-51, rec-54, and dnsdist-21.

sudo apt install curl gnupg ca-certificates
sudo curl -fsSL -o /usr/share/keyrings/pdns-repo-key.gpg \
  https://repo.powerdns.com/FD380FBB-pub.asc
echo "deb [signed-by=/usr/share/keyrings/pdns-repo-key.gpg] \
  http://repo.powerdns.com/ubuntu noble-auth-51 main" \
  | sudo tee /etc/apt/sources.list.d/pdns.list
sudo apt update

For recursor and dnsdist, add the noble-rec-54 and noble-dnsdist-21 lines in the same file. For Rocky Linux, use the repo.powerdns.com/rocky repository with a similar dnf install flow and gpgcheck enabled.

#Installing the Packages

After apt update, install all three daemons at once with the SQLite backend for Authoritative:

sudo apt install pdns-server pdns-backend-sqlite3 pdns-recursor dnsdist

#Verifying the Installation

#Check Versions

Make sure all three daemons are installed with the versions we expect:

pdns_server --version
pdns_recursor --version
dnsdist --version

#First Connection Test

Start the Recursor and query through loopback. dig @127.0.0.1 forces dig to ask the server you point at, rather than the system resolver.

sudo systemctl enable --now pdns-recursor
dig @127.0.0.1 google.com A +short

If an IP address like 142.250.4.14 appears, your installation is successful. Note also that on some distributions, pdns-server and pdns-recursor collide over port 53 — if one fails to start, stop the other first or change local-address on one of the daemons. We'll break down this configuration detail starting in episode 3.

#Conclusion

In this Episode 0 you've laid the foundation for the entire series: understanding the networking and Linux skills required, setting up a VM or Docker lab, adding the official PowerDNS repositories, installing pdns-server, pdns-recursor, and dnsdist, and verifying your first query with dig @127.0.0.1.

Key takeaways:

• DNS runs on port 53, using UDP for queries and TCP for zone transfers.
• Master dig, systemctl, and journalctl before moving on to configuration.
• Always install PowerDNS from the official repo.powerdns.com repository, not the distribution's.
• This series targets Authoritative 5.1.3, Recursor 5.4.4, and dnsdist 2.1.0.
• Your first verification is dig @127.0.0.1 google.com A +short, which should return an IP address.

In the next episode we'll cover history, background, and why we need DNS — from the unscalable HOSTS.TXT file of the ARPANET era, the birth of DNS through RFC 882/883 by Paul Mockapetris, to how PowerDNS was born in 1999 and grew into the trio of Authoritative, Recursor, and dnsdist. Make sure your lab is up and running, because the Learning DNS journey has only just begun!