{"id":13929735,"url":"https://github.com/chrisss404/powerdns","last_synced_at":"2025-07-19T11:32:59.837Z","repository":{"id":39905232,"uuid":"189025083","full_name":"chrisss404/powerdns","owner":"chrisss404","description":"PowerDNS dnsdist, recursor, authoritative, and admin interface. Supports DNSCrypt, DoH, and DoT.","archived":false,"fork":false,"pushed_at":"2024-08-04T10:28:01.000Z","size":300,"stargazers_count":52,"open_issues_count":0,"forks_count":18,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-08-08T18:24:37.460Z","etag":null,"topics":["authoritative","dns","dns-over-https","dns-over-tls","dnscrypt","dnsdist","powerdns","powerdns-admin","powerdns-authoritative","powerdns-dnsdist","powerdns-recursor","recursor"],"latest_commit_sha":null,"homepage":"https://hub.docker.com/r/chrisss404/powerdns","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/chrisss404.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"custom":["https://donate.chofer.at"]}},"created_at":"2019-05-28T12:35:15.000Z","updated_at":"2024-08-02T16:06:29.000Z","dependencies_parsed_at":"2024-01-17T05:23:47.651Z","dependency_job_id":"f6649689-2059-4041-90fd-de046e3f0651","html_url":"https://github.com/chrisss404/powerdns","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrisss404%2Fpowerdns","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrisss404%2Fpowerdns/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrisss404%2Fpowerdns/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrisss404%2Fpowerdns/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/chrisss404","download_url":"https://codeload.github.com/chrisss404/powerdns/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":226597805,"owners_count":17657212,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authoritative","dns","dns-over-https","dns-over-tls","dnscrypt","dnsdist","powerdns","powerdns-admin","powerdns-authoritative","powerdns-dnsdist","powerdns-recursor","recursor"],"created_at":"2024-08-07T18:02:31.281Z","updated_at":"2025-07-19T11:32:59.826Z","avatar_url":"https://github.com/chrisss404.png","language":"Shell","funding_links":["https://donate.chofer.at"],"categories":["others"],"sub_categories":[],"readme":"# Introduction\n\nGet your own secure nameserver up and running within minutes, using this dockerized installation of the PowerDNS nameserver.\n\nSource code of PowerDNS here: https://github.com/PowerDNS/pdns\n\n## Private Recursor\n\nSimple example of an ad blocking private recursor that is listening for DNSCrypt and DNS-over-TLS (DoT) queries. Easy setup for any desktop OS using [dnscrypt-proxy](https://github.com/jedisct1/dnscrypt-proxy/wiki/Installation#os-specific-instructions) and Android 9 has native support for [DoT](https://developers.google.com/speed/public-dns/docs/using#android).\n\nCreate private-recursor.yml like this:\n\n    services:\n    \n      gateway:\n        image: jwilder/nginx-proxy:alpine\n        volumes:\n          - \"/var/run/docker.sock:/tmp/docker.sock:ro\"\n          - \"/etc/nginx/vhost.d\"\n          - \"/usr/share/nginx/html\"\n          - \"/etc/nginx/certs\"\n        ports:\n          - \"80:80\"\n    \n      letsencrypt:\n        image: jrcs/letsencrypt-nginx-proxy-companion:latest\n        volumes:\n          - \"/var/run/docker.sock:/var/run/docker.sock:ro\"\n        volumes_from:\n          - gateway\n    \n      dnsdist:\n        image: chrisss404/powerdns:latest-dnsdist\n        environment:\n          - VIRTUAL_HOST=dot.example.com\n          - VIRTUAL_PORT=9999\n          - LETSENCRYPT_EMAIL=you@example.com\n          - LETSENCRYPT_HOST=dot.example.com\n          - DNSDIST_DNSCRYPT=yes\n          - DNSDIST_DNS_OVER_TLS=yes\n          - DNSDIST_DNS_OVER_TLS_DOMAIN=dot.example.com\n        volumes:\n          - \"./blocklist.txt:/etc/dnsdist/blocklist.txt:ro\"\n        volumes_from:\n          - gateway:ro\n        networks:\n          - recursor\n        ports:\n          - \"853:853/tcp\"\n          - \"8443:8443/udp\"\n          - \"8443:8443/tcp\"\n    \n      recursor:\n        image: chrisss404/powerdns:latest-recursor\n        sysctls:\n          - net.ipv6.route.max_size=16384\n        networks:\n          recursor:\n            ipv4_address: 172.31.117.117\n    \n    networks:\n      recursor:\n        ipam:\n          driver: default\n          config:\n            - subnet: \"172.31.117.0/24\"\n\nCreate `blocklist.txt` like this:\n\n    googleadservices.com\n    ...\n\nThen you can do the following:\n\n    # start secure recursor (restart dnsdist after the let's encrypt certificate is created)\n    docker compose -f private-recursor.yml up\n    \n    # get DNSCrypt provider public key fingerprint\n    docker compose -f private-recursor.yml exec dnsdist dnsdist -e 'printDNSCryptProviderFingerprint(\"/var/lib/dnsdist/providerPublic.key\")'\n    \n    # create DNS stamp using python dnsstamps library or visit https://dnscrypt.info/stamps\n    dnsstamp.py dnscrypt -s -a 1.2.3.4:8443 -n 2.dnscrypt-cert.example.com -k 2251:468C:FE4C:C39F:9DF3:C2BA:7C95:ED8F:94F6:06BC:7A24:0493:D168:DE9E:7682:E8AD\n\n### Connect using DNSCrypt Proxy\n\n* Install dnscrypt proxy as described [here](https://github.com/jedisct1/dnscrypt-proxy/wiki/Installation#os-specific-instructions).\n* Configure dnscrypt proxy to use previously created dnsstamp, e.g.: vim /etc/dnscrypt-proxy/dnscrypt-proxy.toml\n\n```diff\n-server_names = ['cisco', 'cloudflare']\n+server_names = ['example']\n\n[static]\n+  [static.'example']\n+  stamp = 'sdns://AQEAAAAAAAAADDEuMi4zLjQ6ODQ0MyAiUUaM_kzDn53zwrp8le2PlPYGvHokBJPRaN6edoLorRsyLmRuc2NyeXB0LWNlcnQuZXhhbXBsZS5jb20'\n```\n\n### Connect using Android\n\n* Go to `Settings` \u003e `Network \u0026 Internet` \u003e `Advanced` \u003e `Private DNS` \u003e `Private DNS provider hostname`\n* Enter DoT hostname: `dot.example.com`\n\n\u003ca href=\"https://raw.githubusercontent.com/chrisss404/powerdns/master/android-dot.png\"\u003e\u003cimg src=\"https://raw.githubusercontent.com/chrisss404/powerdns/master/android-dot.png\" height=\"200\"/\u003e\u003c/a\u003e\n\n\n## Private Authoritative Server\n\nSimple example of full powerdns stack including private authoritative nameserver and admin interface for editing DNS records.\n\nCreate private-authoritative.yml like this:\n\n    services:\n\n      admin:\n        image: chrisss404/powerdns:latest-admin\n        depends_on:\n          - admin-db\n          - authoritative\n        environment:\n          - ADMIN_PDNS_API_KEY=api-secret-authoritative\n          - ADMIN_USER_PASSWORD=very-secret\n        networks:\n          - admin-db\n          - authoritative\n        ports:\n          - \"80:3031\"\n    \n      admin-db:\n        image: postgres:12.1-alpine\n        environment:\n          - POSTGRES_DB=pda\n          - POSTGRES_INITDB_ARGS=--data-checksums\n          - POSTGRES_PASSWORD=pda\n          - POSTGRES_USER=pda\n        networks:\n          - admin-db\n    \n      authoritative:\n        image: chrisss404/powerdns:latest-authoritative\n        depends_on:\n          - authoritative-db\n        environment:\n          - AUTHORITATIVE_API=yes\n          - AUTHORITATIVE_API_KEY=api-secret-authoritative\n          - AUTHORITATIVE_WEBSERVER=yes\n          - AUTHORITATIVE_WEBSERVER_PASSWORD=web-secret-authoritative\n        networks:\n          authoritative:\n            ipv4_address: 172.31.118.118\n          authoritative-db:\n        ports:\n          - \"8081:8081/tcp\"\n    \n      authoritative-db:\n        image: postgres:12.1-alpine\n        environment:\n          - POSTGRES_DB=pdns\n          - POSTGRES_INITDB_ARGS=--data-checksums\n          - POSTGRES_PASSWORD=pdns\n          - POSTGRES_USER=pdns\n        networks:\n          - authoritative-db\n    \n      dnsdist:\n        image: chrisss404/powerdns:latest-dnsdist\n        environment:\n          - DNSDIST_API_KEY=api-secret-dnsdist\n          - DNSDIST_PLAIN=yes\n          - DNSDIST_QUIET=no\n          - DNSDIST_WEBSERVER=yes\n          - DNSDIST_WEBSERVER_PASSWORD=web-secret-dnsdist\n        networks:\n          - recursor\n        ports:\n          - \"1053:53/tcp\"\n          - \"1053:53/udp\"\n          - \"8083:8083/tcp\"\n    \n      recursor:\n        image: chrisss404/powerdns:latest-recursor\n        environment:\n          - RECURSOR_API_KEY=api-secret-recursor\n          - RECURSOR_DNSSEC=validate\n          - RECURSOR_FORWARD_ZONES={\"zone\":\"sys\",\"forwarders\":[\"172.31.118.118\"]}\n          - RECURSOR_QUIET=false\n          - RECURSOR_TRUST_ANCHORS=sys=54970 13 1 27efe1c1a790c3cbb43b947d6d6dfac62507097e\n          - RECURSOR_WEBSERVER=true\n          - RECURSOR_WEBSERVER_PASSWORD=web-secret-recursor\n        sysctls:\n          - net.ipv6.route.max_size=16384\n        networks:\n          recursor:\n            ipv4_address: 172.31.117.117\n          authoritative:\n        ports:\n          - \"8082:8082/tcp\"\n    \n    networks:\n      admin-db:\n      authoritative:\n        ipam:\n          driver: default\n          config:\n            - subnet: \"172.31.118.0/24\"\n      authoritative-db:\n      recursor:\n        ipam:\n          driver: default\n          config:\n            - subnet: \"172.31.117.0/24\"\n\n\nThen you can do the following:\n\n    # start powerdns stack\n    docker compose -f private-authoritative.yml up\n    \n    # send DNS queries\n    dig -p 1053 example.com\n\n    # PowerDNS admin interface\n    http://localhost:80\n    \n    # PowerDNS authoritative stats\n    http://localhost:8081\n\n    # PowerDNS recursor stats\n    http://localhost:8082\n\n    # PowerDNS dnsdist stats\n    http://localhost:8083\n\n\n## Settings\n\n### Admin\n\n| Env-Variable         | Description                                              |\n| -------------------- | -------------------------------------------------------- |\n| ADMIN_DB_HOST        | Postgres host (default: admin-db)                        |\n| ADMIN_DB_NAME        | Postgres database (default: pda)                         |\n| ADMIN_DB_PASS        | Postgres password (default: pda)                         |\n| ADMIN_DB_PORT        | Postgres port (default: 5432)                            |\n| ADMIN_DB_USER        | Postgres username (default: pda)                         |\n| ADMIN_PDNS_API_KEY   | PowerDNS API key (default: pdns)                         |\n| ADMIN_PDNS_API_URL   | PowerDNS API URL (default: http://authoritative:8081/)   |\n| ADMIN_PDNS_VERSION   | PowerDNS version number (default: 4.2.1)                 |\n| ADMIN_SIGNUP_ENABLED | Allow users to sign up (default: no)                     |\n| ADMIN_USER_EMAIL     | Email address of admin user (default: admin@example.org) |\n| ADMIN_USER_FIRSTNAME | First name of admin user (default: Administrator)        |\n| ADMIN_USER_LASTNAME  | Last name of admin user (default: User)                  |\n| ADMIN_USER_PASSWORD  | Password of admin user (default: admin)                  |\n\n\n### Authoritative\n\n| Env-Variable                              | Description                                                                                                                             |\n|-------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|\n| AUTHORITATIVE_ALLOW_AXFR_IPS              | Allow zonetransfers only to these subnets (default: 127.0.0.0/8,::1)                                                                    |\n| AUTHORITATIVE_ALLOW_NOTIFY_FROM           | Allow AXFR NOTIFY from these IP ranges (default: 0.0.0.0/0,::/0)                                                                        |\n| AUTHORITATIVE_API                         | Enable/disable the REST API (default: no)                                                                                               |\n| AUTHORITATIVE_API_KEY                     | Static pre-shared authentication key for access to the REST API (default: pdns)                                                         |\n| AUTHORITATIVE_DB_HOST                     | Postgres host (default: authoritative-db)                                                                                               |\n| AUTHORITATIVE_DB_NAME                     | Postgres database (default: pdns)                                                                                                       |\n| AUTHORITATIVE_DB_PASS                     | Postgres password (default: pdns)                                                                                                       |\n| AUTHORITATIVE_DB_PORT                     | Postgres port (default: 5432)                                                                                                           |\n| AUTHORITATIVE_DB_USER                     | Postgres username (default: pdns)                                                                                                       |\n| AUTHORITATIVE_DEFAULT_KSK_ALGORITHM       | Default KSK algorithm (default: ecdsa256)                                                                                               |\n| AUTHORITATIVE_DEFAULT_KSK_SIZE            | Default KSK size (default: 0)                                                                                                           |\n| AUTHORITATIVE_DEFAULT_PUBLISH_CDNSKEY     | Default value for PUBLISH-CDNSKEY (default: )                                                                                           |\n| AUTHORITATIVE_DEFAULT_PUBLISH_CDS         | Default value for PUBLISH-CDS (default: )                                                                                               |\n| AUTHORITATIVE_DEFAULT_ZSK_ALGORITHM       | Default ZSK algorithm (default: )                                                                                                       |\n| AUTHORITATIVE_DEFAULT_ZSK_SIZE            | Default ZSK size (default: 0)                                                                                                           |\n| AUTHORITATIVE_DIRECT_DNSKEY               | Fetch DNSKEY, CDS and CDNSKEY RRs from backend during DNSKEY or CDS/CDNSKEY synthesis (default: no)                                     |\n| AUTHORITATIVE_DISABLE_AXFR                | Disable zonetransfers but do allow TCP queries (default: yes)                                                                           |\n| AUTHORITATIVE_DNAME_PROCESSING            | If we should support DNAME records (default: no)                                                                                        |\n| AUTHORITATIVE_EXPAND_ALIAS                | Expand ALIAS records (default: no)                                                                                                      |\n| AUTHORITATIVE_LOG_DNS_DETAILS             | If PDNS should log DNS non-erroneous details (default: no)                                                                              |\n| AUTHORITATIVE_LOG_DNS_QUERIES             | If PDNS should log all incoming DNS queries (default: no)                                                                               |\n| AUTHORITATIVE_LOGLEVEL                    | Amount of logging. Higher is more. Do not set below 3 (default: 4)                                                                      |\n| AUTHORITATIVE_MASTER                      | Act as a master (default: no)                                                                                                           |\n| AUTHORITATIVE_MAX_TCP_CONNECTION_DURATION | Maximum time in seconds that a TCP DNS connection is allowed to stay open (default: 0)                                                  |\n| AUTHORITATIVE_MAX_TCP_CONNECTIONS         | Maximum number of TCP connections (default: 20)                                                                                         |\n| AUTHORITATIVE_QUERY_LOGGING               | Hint backends that queries should be logged (default: no)                                                                               |\n| AUTHORITATIVE_RECEIVER_THREADS            | Default number of receiver threads to start (default: 1)                                                                                |\n| AUTHORITATIVE_RESOLVER                    | Use this resolver for ALIAS and the internal stub resolver (default: no)                                                                |\n| AUTHORITATIVE_RETRIEVAL_THREADS           | Number of AXFR-retrieval threads for slave operation (default: 2)                                                                       |\n| AUTHORITATIVE_REUSEPORT                   | Enable higher performance on compliant kernels by using SO_REUSEPORT allowing each receiver thread to open its own socket (default: no) |\n| AUTHORITATIVE_SECURITY_POLL_SUFFIX        | Domain name from which to query security update notifications (default: secpoll.powerdns.com.)                                          |\n| AUTHORITATIVE_SLAVE                       | Act as a slave (default: no)                                                                                                            |\n| AUTHORITATIVE_SIGNING_THREADS             | Default number of signer threads to start (default: 3)                                                                                  |\n| AUTHORITATIVE_TCP_FAST_OPEN               | Enable TCP Fast Open support on the listening sockets (default: 0)                                                                      |\n| AUTHORITATIVE_WEBSERVER                   | Start a webserver for monitoring on port 8081 (default: no)                                                                             |\n| AUTHORITATIVE_WEBSERVER_PASSWORD          | Password required for accessing the webserver (default: pdns)                                                                           |\n\n\n### Dnsdist\n\n| Env-Variable                   | Description                                                                     |\n| ------------------------------ | ------------------------------------------------------------------------------- |\n| DNSDIST_API_KEY                | Static pre-shared authentication key for access to the REST API (default: pdns) |\n| DNSDIST_DNSCRYPT               | Listen for DNSCrypt queries on port 8443 (default: no)                          |\n| DNSDIST_DNSCRYPT_PROVIDER_NAME | DNSCrypt provider name (default: 2.dnscrypt-cert.example.com)                   |\n| DNSDIST_DNS_OVER_HTTPS         | Listen for DNS-over-HTTPS queries on port 443 (default: no)                     |\n| DNSDIST_DNS_OVER_HTTPS_DOMAIN  | Domain name of DNS server.                                                      |\n| DNSDIST_DNS_OVER_HTTPS_PATH    | The absolute URI path. (default: /dns-query)                                    |\n| DNSDIST_DNS_OVER_TLS           | Listen for DNS-over-TLS queries on port 853 (default: no)                       |\n| DNSDIST_DNS_OVER_TLS_DOMAIN    | Domain name of DNS server.                                                      |\n| DNSDIST_PLAIN                  | Listen for plain DNS queries on port 53 (default: no)                           |\n| DNSDIST_QUIET                  | Suppress logging of questions and answers (default: no)                         |\n| DNSDIST_WEBSERVER              | Start a webserver for REST API on port 8083 (default: no)                       |\n| DNSDIST_WEBSERVER_PASSWORD     | Password required for accessing the webserver (default: pdns)                   |\n\n\n### Recursor\n\n| Env-Variable                   | Description                                                                                                                               |\n|--------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|\n| RECURSOR_ALLOW_FROM            | If set, only allow these comma separated netmasks to recurse                                                                              |\n| RECURSOR_API_KEY               | Static pre-shared authentication key for access to the REST API (default: pdns)                                                           |\n| RECURSOR_DNSSEC                | DNSSEC mode: off / process-no-validate (default) / process / log-fail / validate                                                          |\n| RECURSOR_FORWARD_ZONES         | Zones for which we forward queries, comma separated ForwardZones, e.g.: {\"zone\":\"sys\",\"forwarders\":[\"172.31.118.118\"]}                    |\n| RECURSOR_FORWARD_ZONES_RECURSE | Zones for which we forward queries with recursion bit, comma separated ForwardZones, e.g.: {\"zone\":\"sys\",\"forwarders\":[\"172.31.118.118\"]} |\n| RECURSOR_LOGLEVEL              | Amount of logging. Higher is more. Do not set below 3 (default: 6)                                                                        |\n| RECURSOR_QUIET                 | Suppress logging of questions and answers (default: false)                                                                                |\n| RECURSOR_SECURITY_POLL_SUFFIX  | Domain name from which to query security update notifications (default: secpoll.powerdns.com.)                                            |\n| RECURSOR_TCP_FAST_OPEN         | Enable TCP Fast Open support on the listening sockets, using the supplied numerical value as the queue size                               |\n| RECURSOR_THREADS               | Launch this number of threads                                                                                                             |\n| RECURSOR_TRUST_ANCHORS         | Trust anchors for private zones when using DNSSEC validation, comma separated domain=ds-key pairs                                         |\n| RECURSOR_WEBSERVER             | Start a webserver for REST API on port 8082 (default: false)                                                                              |\n| RECURSOR_WEBSERVER_PASSWORD    | Password required for accessing the webserver (default: pdns)                                                                             |\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchrisss404%2Fpowerdns","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchrisss404%2Fpowerdns","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchrisss404%2Fpowerdns/lists"}