pdns

True for API but you can do DynDNS updates (RFC 2136), TSIG-authenticated on a per-zone basis. [1] Can even be controlled quite granularly with a Lua-based updatepolicy, if you want e.g. restricting to only the ACME TXT records. [2] [1] https://doc.powerdns.com/authoritative/dnsupdate.html [2] https://github.com/PowerDNS/pdns/wiki/Lua-Examples-(Authorit...

Relevant PR: https://github.com/PowerDNS/pdns/pull/13008.

Example in PowerDNS, where the allowance for the "IN" class is hard-coded to remove ambiguity: https://github.com/PowerDNS/pdns/blob/master/pdns/zoneparser... And in BIND where the <rdata> parsing is coded up for a bunch of <type>'s: https://github.com/isc-projects/bind9/tree/main/lib/dns/rdat...

I think that page would have been incredibly useful, but doesn't look like it existed. I was just looking through the source history of the project a bit as I wasn't the original developer (I've just done some fixes; most recently fixing some things going from 4.2 to 4.4). The original code was written in 2016, when the documentation was a lot more sparse [1]. Kudos for the improvements! I just filed a PR [2] fixing the doc issues I ran into (probably should have done that at the time). To enumerate some things I see right now (using remote http backend): * pdns always queries /lookup/example.com./SOA, /getAllDomainMetadata/example.com. /lookup/example.com./ANY -- in my case that seems a bit wasteful: there's no metadata, and SOA is returned in the /ANY request anyway. I'm unclear if there's a misconfiguration, something we're doing wrong

likely your DNS server is using PowerDNS. Versions before 4.1.0-rc1 had a bug with the query cache: https://github.com/PowerDNS/pdns/issues/6806 This issue isn't affected by the configuration change on flag day and judging by the slow adoption so far, by the time where edns support really gets mandatory, the current version of the distro at that time will long have updated their built-in PowerDNS version.

Depends on your skill set. If you're ok with *nix, then PowerDNS is pretty simple to work with: https://github.com/PowerDNS/pdns It's also fairly complete, used in production by some pretty big ISPs. For a light weight approach instead, Dnsmasq is good: http://www.thekelleys.org.uk/dnsmasq/doc.html It's what most home routers (and lots of other stuff) embed. :)

PowerDNS recursor support issue is here: https://github.com/PowerDNS/pdns/issues/2311

If you are going this scale, there is another way: Use your own DNS server and try the DNS-01 challenge. My setup works with [0]letsencrypt.sh, [1]pdns_api.sh, [2]PowerDNS4 (MySQL backend w/ replication) and a little script that distributes the certs and restarts services. The nice thing is, this works for anything you can put in DNS, you do not need not to respond to a HTTP request for a name (think mail server). [0] https://github.com/lukas2511/letsencrypt.sh [1] https://github.com/silkeh/pdns_api.sh [2] https://github.com/PowerDNS/pdns

That was what I was thinking but it was stupid idea. My point is that if you could use this bug to use one rogue DNS to own other DNSes this could be leveraged to bring large parts of the Internet down. I don't know how hard or easy this could be. A quick glance into PDNS reveals four calls to getaddrinfo()[1]. So it might be possible... [1] https://github.com/PowerDNS/pdns/search?utf8=%E2%9C%93&q=get...

I'm out of my element here but is it really so far fetched? A quick search in the PowerDNS codebase [1] reveals four sites where getaddrinfo() is called. This isn't obviously the code for recursive lookups but that doesn't matter. If an attacker can trick it to query their rogue DNS they have won. I don't want to suggest that Google uses PowerDNS, I just used is as an example. [1] https://github.com/PowerDNS/pdns/search?utf8=%E2%9C%93&q=get...