PowerDNS Authoritative

In the AWS Marketplace console, search for PowerDNS Authoritative Server and select the SecureAnyCloud listing. Choose Continue to Subscribe, then Continue to Launch.

Choose the m5.large instance type and your key pair. Choose a security group that allows UDP 53 and TCP 53 (DNS) from your client networks and TCP 22 for administration.

DNS uses UDP 53 for most queries and falls back to TCP 53 for large responses and zone transfers, so open both. The REST API stays on loopback and is never exposed.

aws ec2 run-instances \
  --image-id ami-<powerdns-authoritative-ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=ns1}]'

The security group in this command must open TCP 22 and both UDP and TCP 53.

On first boot, the image generates a fresh per-instance REST API key and database password and provisions the demonstration example.com zone. It then starts pdns, verifies that the API key round-trips and the zone resolves, and writes /root/powerdns-credentials.txt.

This completes within a minute. SSH in as ubuntu and read the details:

sudo cat /root/powerdns-credentials.txt

pdns.service (the PowerDNS daemon) and mariadb.service (the database backend) are both active. ss confirms DNS is listening on :53 (UDP and TCP, all interfaces) while the REST API is bound to 127.0.0.1:8081 only. Run:

systemctl is-active pdns.service mariadb.service pdns_server --version ss -tlnup | grep -E ':53 |:8081 '

The image ships one demonstration zone, example.com, so a DNS round trip works immediately. Query it against the loopback address, or against the instance public IP from a client.

The aa flag in the header confirms an authoritative answer. The demonstration records use the 203.0.113.10 documentation address, which you replace with your own.

dig @127.0.0.1 www.example.com dig @127.0.0.1 example.com SOA +short dig @127.0.0.1 example.com NS +short

The REST API is the same interface used by web control panels and automation tools. Read your per-instance API key from the credentials file into a shell variable. Then call the server info endpoint. It is bound to loopback, so run these commands on the instance or tunnel port 8081 over SSH.

API_KEY=$(sudo grep '^powerdns.api.key=' /root/powerdns-credentials.txt | cut -d= -f2-)
curl -s -H "X-API-Key: $API_KEY" http://127.0.0.1:8081/api/v1/servers/localhost | jq . pdnsutil list-all-zones

A request without the key is rejected with HTTP 401, and a request with the key returns HTTP 200:

API_KEY=$(sudo grep '^powerdns.api.key=' /root/powerdns-credentials.txt | cut -d= -f2-)
echo -n 'with key : HTTP '; curl -s -o /dev/null -w '%{http_code}\n' -H "X-API-Key: $API_KEY" http://127.0.0.1:8081/api/v1/servers/localhost
echo -n 'without key : HTTP '; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8081/api/v1/servers/localhost

No default or shared credentials ship in the image. The credentials file is 0600 root:root and the secrets drop-in is 0640 root:pdns. The API key and database password are unique to this instance, the backend is MariaDB (gmysql), and the REST API is bound to loopback only.

Verify it:

sudo stat -c '%n %a %U:%G' /root/powerdns-credentials.txt grep -E 'launch|gmysql-dbname|webserver-address|api=' /etc/powerdns/pdns.d/sac-pdns.conf

Replace the demonstration zone with your own domain. Create the zone and add records with pdnsutil. The zone list cache is disabled on this appliance, so new zones and records are served immediately with no reload.

pdnsutil zone create <your-domain> pdnsutil rrset add <your-domain> <your-domain> NS 3600 "ns1.<your-domain>." pdnsutil rrset add <your-domain> www A 3600 "203.0.113.20" pdnsutil rrset add <your-domain> @ A 3600 "203.0.113.20" pdnsutil zone list <your-domain> dig @127.0.0.1 www.<your-domain>
# once your own <your-domain> zone resolves, remove the demonstration zone: pdnsutil zone delete example.com

You can also create zones and records through the REST API, which is how automation and control panels drive PowerDNS. This example creates a zone with a single POST:

API_KEY=$(sudo grep '^powerdns.api.key=' /root/powerdns-credentials.txt | cut -d= -f2-)
curl -s -H "X-API-Key: $API_KEY" -H 'Content-Type: application/json' \
  -X POST http://127.0.0.1:8081/api/v1/servers/localhost/zones \
  -d '{"name":"<your-domain>.","kind":"Native","nameservers":["ns1.<your-domain>."]}'

PowerDNS signs zones with a single command. Secure your zone. Then publish the DS record that it prints at your registrar, so resolvers can validate your answers.

pdnsutil secure-zone <your-domain> pdnsutil show-zone <your-domain> pdnsutil export-zone-ds <your-domain>

Point your domain registrar's name server (NS) records at this instance's public IP, so that the internet queries this server for your zone. Confirm from an external client:

dig @<public-ip> www.<your-domain>

For resilience, run a second PowerDNS instance as a secondary. Scope zone transfers (AXFR) to its address with the allow-axfr-ips setting or with per-zone ALLOW-AXFR-FROM metadata.

• Restrict the security group. Allow UDP and TCP 53 only from the client networks that need to query the server, and TCP 22 for administration only. The REST API stays on loopback. Tunnel port 8081 over SSH if you need it remotely.
• Keep the REST API on loopback. The image binds the API and status webserver to 127.0.0.1 and sets webserver-allow-from to loopback. Do not expose it directly. If you need remote API access, front it with a reverse proxy and TLS.
• Enable DNSSEC for production zones (Step 10), so resolvers can validate your answers.
• Add secondary servers and scope AXFR zone transfers to their addresses rather than leaving them open.
• Keep the OS and PowerDNS patched, including the official PowerDNS repository for the auth 51 branch.
• Back up the database. Your zones and records live in the MariaDB powerdns database. Take regular mysqldump backups.

PowerDNS Authoritative Server is developed by PowerDNS.COM BV and distributed under the GNU General Public License version 2 (GPL-2.0) with an OpenSSL linking exception (see the upstream NOTICE file). This SecureAnyCloud image bundles the unmodified official PowerDNS packages. SecureAnyCloud provides the packaging, the MariaDB backend integration, the per-instance credential automation, the demonstration zone and 24/7 support.

SecureAnyCloud is not affiliated with or endorsed by PowerDNS.COM BV. PowerDNS is a mark of its respective owner and is used here only to identify the software.

Deploy on AWS

Find PowerDNS Authoritative Server on the AWS Marketplace, published by SecureAnyCloud. Deploy from the Console or the AWS CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on AWS

Launch PowerDNS Authoritative Server with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com