PowerDNS option to allow AXFR from all secondary servers

Created: — modified: — tags: dns

Does your list of nameservers change often?

First thing that you should know about DNS zone transfers (AXFR) is that you shouldn't expose them to the whole Internet. If you don't know that, please learn it (elsewhere) before enabling AXFR anywhere, and always keep it in mind.

Next, reading PowerDNS docs for allow-axfr-ips option, you will see its rather limited set of options. Basically, you're expected to have a list of all your secondary DNS servers on you primary DNS server.1 But what if you want to configure it more dynamically?

Then you might be happy to learn that there is a similarly-named ALLOW-AXFR-FROM per-zone option. Unlike its more global brother, it has a magical2 value AUTO-NS that, according to docs, "tries to allow all potential secondaries in", and according to an old PowerDNS blog post, "allows any IP address listed as a nameserver for this domain to transfer it".

Sounds reasonable, since you can use PowerDNS API to update list of nameservers for your domain. To set it for a domain, you just execute this on your primary DNS server:

pdnsutil metadata set example.org ALLOW-AXFR-FROM AUTO-NS

Note, however, that for this option to work you need to set allow-axfr-ips= in pdns.conf (to allow anyone to request zone transfers, on global PowerDNS level).

Also note that docs don't specify what happens if you have allow-axfr-ips= in pdns.conf (i.e. allow anyone to request zone transfers), and don't specify ALLOW-AXFR-FROM for a zone. Will it allow zone transfers to anyone or to nobody? I'd err on the side of caution and remember to specify ALLOW-AXFR-FROM for all zones in such setup.

  1. I'm assuming a rather simple system here, where all your DNS servers are publicly exposed and listed in NS records ↩

  2. It's called "magical value" in the official docs, indeed ↩