PowerDNS Auth + Recurs | Forwarded->Zone not replying with A Record

[dj-money]

I followed instructions on getting PowerDNS online. I have Primary/Secondary MySQL Backend, both with Auth and Recursor installed. Recursor is bound to :53 and forwards using this in its config:

forward-zones=ongaku.gg=127.0.0.1:5300

ongaku.gg is configured correctly (SOA, NS Records, A Records for ns1,ns2) in PowerDNS.
Glue Records are configured at the Registrar correctly.

I'm having issues pinging ns1/ns2 on some hosts (dns propagation issue)?
I cannot ping an A record (storage.ongaku.gg).

I feel like I'm super close to figuring it out. Any nudges in the right direction, or do I have something misconfigured? Or is this simply DNS Propagation (I started with fresh boxes yesterday, never touched PowerDNS before).

[writeDavid]

Here is the output for that:

dig @8.8.8.8 storage.ongaku.gg

; <<>> DiG 9.18.26 <<>> @8.8.8.8 storage.ongaku.gg
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 56601
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512

; EDE: 23 (Network Error): ([85.239.236.94] rcode=REFUSED for storage.ongaku.gg/a)
; EDE: 23 (Network Error): ([154.12.246.137] rcode=REFUSED for storage.ongaku.gg/a)
; EDE: 22 (No Reachable Authority): (At delegation ongaku.gg for storage.ongaku.gg/a)

;; QUESTION SECTION:
;storage.ongaku.gg. IN A

;; Query time: 193 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Sat May 18 10:52:24 PDT 2024
;; MSG SIZE rcvd: 218

[writeDavid]

Odd, that when you query your powerdns server itself, it responds without issue:

dig @154.12.246.137 storage.ongaku.gg

; <<>> DiG 9.18.26 <<>> @154.12.246.137 storage.ongaku.gg
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55521
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;storage.ongaku.gg. IN A

;; ANSWER SECTION:
storage.ongaku.gg.	3600	IN	A	84.247.156.160

;; Query time: 84 msec
;; SERVER: 154.12.246.137#53(154.12.246.137) (UDP)
;; WHEN: Sat May 18 11:01:53 PDT 2024
;; MSG SIZE rcvd: 62

[writeDavid]

I would try troubleshooting the issue with default config files for both pdns and recursor, though how to get your hands on them, i'm not too sure.

[writeDavid]

I would suggest moving to Issues.

[omoerbeek]

Right now you seem to be exposing your recursor to the internet, that is not a good thing.

A recursor cannot serve as a an authoritative server (note the lack of aa (authoritaitve answer) bit and the presence of the ra (recursion available) bit in the answer above. The public internet needs to talk to the authoritative server itself without a recursor in between.

[dj-money]

So I would need to use dnsdist in front of both, to have both running on the same server?

[omoerbeek]

Not necessarily. You can e.g. run them on different IPs, as long as requests to the public IP port 53 end in in the authoritative server. Again: do no run the recursor on a IP that exposed to the internet. Running a public recursive server is not something you want to do by accident.