Hi r/linuxadmin,

I'm trying to migrate from Bind9 to PowerDNS and I have trouble finding an option to implement private (only for my company's IPs) resolvable domains on an authoritative PowerDNS server. My setup looks something like this:

---- Public Zone ----------

+-----------+
| pdns auth | <- Everyone can query
| secondary | <---------------------+
+-----------+                       |
                                  AXFR
---- Company Zone ---------         |
                                    |
        +---------------+           |
        | pdns recursor | <- My users and customers can query
        +---------------+           |
                                    |
---- Private Zone ---------         | 
                                    |
+-----------+                       |
| pdns auth |-----------------------+
| primary   | <- No one can query
+-----------+

There is a hidden primary that holds all public and private domains and sends them to the secondary via AXFR. Everyone can query the secondary for the public zones. The recursor works as a resolver for my users and our customers. If for example one of my users queries the recursor for one of our domains, then the recursor makes a recursive query beginning with the root nameservers, until it get't it's answer from the secondary in the public zone.

What I want to setup is, that the secondary hold it's public zones and private sub-zones, which can only be queried by the recursor and internal IPs. With Bind9 this setup would look like this:

# declare ACL with company IPs
acl "company" { 198.51.100.0 /24; 203.0.113.0 /24; };
# In this example we hold example.com
zone "example.com" { type slave; file "db.example.com"; masters { "primary"; }; allow-query { any; }; };
# Add pritvate sub-zone
zone "private.example.com" { type slave; file "db.private.example.com"; masters { "primary"; }; allow-query { "company"; }; };

The PowerDNS documentation points to these examples:

Authoritative Server as Recursor with private zones

• This example laks any ACL feature, which is needed to differentiative the source IPs to allow/disallow a query for a private zone.
• It assumes I want a resolver on an authoritative server, which I do not.

Authoritative Server as Recursor for clients and serving public domains

• This example uses dnsdist to make ACLs based on the source IP, which goes in the right direction.
• But it still implements a resolver, which again is not needed.
• It requires that you add every authoritative zone by hand to the recursor config, which takes away every advantage that I get from migrating to PowerDNS.

Do any of you have any ideas on how I can make this work?