PowerDNS Authoritative Server answers DNS queries for your domains, like the nameservers at a DNS provider, but on your own servers. It stores zones in a database (SQLite, MySQL/MariaDB or PostgreSQL), has a clean CLI (pdnsutil) and an HTTP API, and supports DNSSEC with almost no extra work. Hosting providers and companies with many domains use it to manage DNS programmatically.

Before you self-host authoritative DNS, remember that DNS is critical infrastructure. If your nameservers go down, every website and mailbox on those domains becomes unreachable. You need at least two servers on different networks, ideally in different locations. For a handful of domains, a managed anycast DNS provider is usually more reliable. See nameservers explained.

Recursor vs authoritative

PowerDNS has two separate products:

  • pdns-server (Authoritative) serves your zones. This guide.
  • pdns-recursor is a resolver for clients, like Unbound. See Unbound.

Don’t run both on the same IP and port without a clear design.

Install (Debian/Ubuntu, SQLite backend)

sudo apt install pdns-server pdns-backend-sqlite3 sqlite3

Ubuntu’s systemd-resolved listens on 127.0.0.53, while PowerDNS needs port 53 on the public IP. Bind PowerDNS explicitly:

# /etc/powerdns/pdns.conf
local-address=203.0.113.53
launch=gsqlite3
gsqlite3-database=/var/lib/powerdns/pdns.sqlite3

Create the database from the schema shipped with the package:

sudo mkdir -p /var/lib/powerdns
sudo sqlite3 /var/lib/powerdns/pdns.sqlite3 < /usr/share/doc/pdns-backend-sqlite3/schema.sqlite3.sql
sudo chown -R pdns:pdns /var/lib/powerdns
sudo systemctl restart pdns

(Use the MySQL or PostgreSQL backend for larger setups or database replication. The steps are similar, with gmysql or gpgsql settings.)

Open the firewall:

sudo ufw allow 53/udp
sudo ufw allow 53/tcp

TCP 53 is required. Large responses (DNSSEC, many records) and zone transfers use it.

Create a zone and records

sudo -u pdns pdnsutil create-zone example.com ns1.example.com
sudo -u pdns pdnsutil add-record example.com @ A 3600 203.0.113.10
sudo -u pdns pdnsutil add-record example.com www CNAME 3600 example.com.
sudo -u pdns pdnsutil add-record example.com @ MX 3600 "10 mail.example.com."
sudo -u pdns pdnsutil add-record example.com @ TXT 3600 '"v=spf1 mx -all"'
sudo -u pdns pdnsutil add-record example.com ns1 A 3600 203.0.113.53
sudo -u pdns pdnsutil add-record example.com ns2 A 3600 198.51.100.53
sudo -u pdns pdnsutil add-record example.com @ NS 3600 ns2.example.com.
sudo -u pdns pdnsutil check-zone example.com
sudo -u pdns pdnsutil list-zone example.com

Edit interactively with pdnsutil edit-zone example.com (opens the zone in your editor and bumps the serial).

Test against your server:

dig @203.0.113.53 example.com A +norecurse
dig @203.0.113.53 example.com SOA

See DNS records explained.

Primary and secondary servers

The second nameserver can be a PowerDNS secondary that copies zones via AXFR/IXFR:

On the primary (pdns.conf):

primary=yes
allow-axfr-ips=198.51.100.53/32
also-notify=198.51.100.53

On the secondary:

secondary=yes
autosecondary=yes

Register the primary as a trusted “autoprimary” on the secondary, and zones appear automatically when the primary sends NOTIFY. Alternatively, use database replication (MySQL or PostgreSQL) with both servers in native mode.

Then, at your registrar:

  1. create glue records for ns1.example.com and ns2.example.com with their IPs;
  2. set the domain’s nameservers to ns1.example.com and ns2.example.com.

DNSSEC in two commands

sudo -u pdns pdnsutil secure-zone example.com
sudo -u pdns pdnsutil show-zone example.com     # shows the DS records

Give the DS record to your registrar to complete the chain of trust. PowerDNS signs responses automatically. When moving DNS elsewhere later, remove the DS first.

API and web UI

Enable the HTTP API for automation (ACME DNS challenges, provisioning):

api=yes
api-key=<long-random-key>
webserver=yes
webserver-address=127.0.0.1
webserver-port=8081
webserver-allow-from=127.0.0.1

Popular web UIs like PowerDNS-Admin use this API. Keep it on localhost or behind authentication, never public. Certbot and acme.sh have PowerDNS plugins for wildcard certificates. See acme.sh.

Operational tips

  • Monitor both nameservers from outside: query them for SOA every minute, and alert on failures or serial mismatches.
  • Rate limit or protect against abuse. Authoritative servers can be used for amplification too. Response rate limiting is available via dnsdist in front of PowerDNS.
  • Back up the database, and test restores.
  • Keep TTLs sensible: 3600 for most records, lower before planned changes. See DNS propagation.

Quick reference

Task Command
Create zone pdnsutil create-zone DOMAIN NS
Add record pdnsutil add-record ZONE NAME TYPE TTL CONTENT
Edit zone pdnsutil edit-zone ZONE
Check pdnsutil check-zone ZONE
DNSSEC pdnsutil secure-zone ZONE
Test dig @server ZONE SOA +norecurse

Related: nameservers explained and CAA records.

  • DNS
  • Self-Hosting
  • Networking