Learning DNS - Installation & Initial Setup

#Introduction

In episode 0 you added the official repo and installed the packages. Now it's time to make all three daemons actually work: Authoritative, Recursor, and dnsdist. Episode 3 covers the configuration structure of each, how to manage their services, and verifying that everything listens on the right ports.

There's one important fact that shapes the configuration style: Authoritative uses pdns.conf in key-value style, while the latest versions of Recursor and dnsdist use YAML. With dnsdist 2.1, YAML configuration (dnsdist.yml) becomes the primary style, although legacy Lua support remains. These three files are the control center for the entire series.

#Authoritative Configuration Structure

#pdns.conf: Simple Key-Value

The main Authoritative file is /etc/powerdns/pdns.conf. Its format is simple: one key=value per line, with comments starting with #. Here's a minimal example ready for your lab:

launch=gsqlite3
gsqlite3-database=/var/lib/powerdns/pdns.sqlite3
local-address=127.0.0.1
local-port=53
default-soa-content=ns1.example.com hostmaster.example.com 0 10800 3600 604800 3600

Notice launch=gsqlite3 — this selects the backend. local-address and local-port determine where the daemon listens. default-soa-content becomes the SOA template for zones you create later.

#Syntax Verification

Never start a service before checking the configuration:

pdns_server --config-check
sudo systemctl enable --now pdns
sudo systemctl status pdns

If pdns_server --config-check produces no errors, your configuration is valid.

#Recursor Configuration Structure

#recursor.yml: YAML Style

Recursor 5.4 reads /etc/powerdns/recursor.yml. Here's a basic example: listening on loopback and allowing queries only from the local network.

listen-addresses:
  - 127.0.0.1
  - 192.0.2.53
allow-from:
  - 192.0.2.0/24
  - 127.0.0.0/8
dnssec:
  process: true
threads: 4

The dnssec.process: true field enables DNSSEC validation — we'll cover it in depth in episode 14. For now, run and test:

sudo systemctl enable --now pdns-recursor
dig @127.0.0.1 example.com A +short

The Recursor has built-in root hints, so without any additional configuration it can already resolve names from the internet.

#dnsdist Configuration Structure

#dnsdist.yml and Console

dnsdist 2.1 supports dnsdist.yml for static configuration. The example below places dnsdist on port 53 and forwards all queries to the Recursor at 127.0.0.1:5300.

setLocal:
  - address: 0.0.0.0:53
newServer:
  - address: 127.0.0.1:5300
acl:
  - 192.0.2.0/24
  - 127.0.0.0/8

Before running, make sure the Recursor listens on 127.0.0.1:5300 by adjusting listen-addresses in recursor.yml. Then start dnsdist:

sudo systemctl enable --now dnsdist
dig @127.0.0.1 example.com A +short

#The Interactive dnsdist Console

dnsdist also has an interactive console for quick debugging. Run dnsdist -c to connect to the running instance and view backend status:

dnsdist -c
showServers()
quit()

The output of showServers() shows every backend with its up/down status and the number of queries served — a tool that will be very useful in episodes 7 and 17.

#Service Management and the Port 53 Conflict

#Arranging Ports so They Don't Collide

All three daemons default to listening on port 53, so in a single-machine lab they'll fight over it. The pattern used throughout this series: Authoritative on 127.0.0.1:53, Recursor on 127.0.0.1:5300, and dnsdist on 0.0.0.0:53. Adjustments are made via local-address and listen-addresses, which we've already seen.

sudo ss -tulpn | grep ':53 '

#Checking Logs

When something isn't behaving as expected, the logs are the first source of truth:

journalctl -u pdns -n 50 --no-pager
journalctl -u pdns-recursor -n 50 --no-pager
journalctl -u dnsdist -n 50 --no-pager

journalctl -u pdns -n 50 shows the last 50 lines of the Authoritative service log. In episode 8 we'll cover how to read these logs for more systematic diagnosis.

#Conclusion

Episode 3 closes the gap between installation and operation: you now know where each daemon's configuration lives and what it looks like, how to verify syntax, manage systemd services, separate ports so they don't collide, and read logs when something goes wrong.

Key takeaways:

• Authoritative uses key-value pdns.conf; Recursor and dnsdist use YAML.
• Run pdns_server --config-check before starting Authoritative.
• dig @127.0.0.1 example.com A is the most reliable quick test for all daemons.
• All three daemons fight over port 53: separate them with local-address and listen-addresses.
• The dnsdist console (dnsdist -c) shows backend status in real time.
• journalctl is the first source of truth when a service isn't running normally.

In the next episode we'll cover zones and resource record types — the concept of zone versus domain, the full SOA format with serial and timing parameters, record types from A to SVCB/HTTPS, and the difference between BIND-style zone files and database storage in PowerDNS.