Table of Contents
Starting with the PowerDNS Authoritative Server 3.4, RFC2136 support is available. There are a number of items NOT supported:
There is no support for GSS-TSIG and SIG (TSIG is supported);
WKS records are specifically mentioned in the RFC, we don't specifically care about WKS records;
Anything we forgot....
The implementation requires the backend to support a number of new oparations. Currently, the following backends have been modified to support RFC2136:
gmysql
gpgsql
gsqlite3
There are two configuration parameters that can be used within the powerdns configuration file.
A setting to enable/disable RFC2136 support completely. The default is no, which means that RFC2136 updates are ignored by PowerDNS (no message is logged about this!). Change the setting to experimental-rfc2136=yes to enable RFC2136 support.
A list of IP ranges that are allowed to perform updates on any domain. The default is 0.0.0.0/0, which means that all ranges are accepted. Multiple entries can be used on this line (allow-2136-from=10.0.0.0/8 192.168.1.2/32). The option can be left empty to disallow everything, this then should be used in combination with the allow-2136-from domainmetadata setting per zone.
Tell PowerDNS to forward to the master server if the zone is configured as slave. Masters are determined by the masters field in the domains table. The default behaviour is enabled (yes), which means that it will try to forward. In the processing of the update packet, the allow-2136-from and TSIG-2136-ALLOW are processed first, so those permissions apply before the forward-2136 is used. It will try all masters that you have configured until one is successful.