resolution & pdnsutil edit-zone fails - authoritive and recursor on one server

[HachimanSec]

Hi,
I am very new to PowerDNS and want to achieve the following:

Internaly setup of the authoritive server and the recursor.
My official domain is resolved by Cloudflare externally.
Internally I want to use the authoritive server to resolve my domain for some additional services that should not be exposed on the internet and resolve only to private IPs.

I have setup the authoritive server and the recursor based on this manual: Scenario 1: Authoritative Server as Recursor with private zones

Authoritive server is listening on port 5300 and recursor on 53.

Based on the docs I create a first zone and record:

sudo -u pdns pdnsutil create-zone my.domain ns1.my.domain
sudo -u pdns pdnsutil add-record my.domain. firewall-int A 10.0.1.1

Now there are two issues.
First is that resolution of the record fails:

dig firewall-int.my.domain. @127.0.0.1
;; communications error to 127.0.0.1#53: connection refused
;; communications error to 127.0.0.1#53: connection refused
;; communications error to 127.0.0.1#53: connection refused

; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> firewall.my.domain. @127.0.0.1
;; global options: +cmd
;; no servers could be reached

And the second problem is that edit-zone doesnt work - even though I have $EDITOR and the default editor in sudoers file (nano):

sudo -u pdns pdnsutil edit-zone my.domain
sudo: pdnsutil edit-zone: command not found

However list-zone works:

sudo -u pdns pdnsutil list-zone my.domain
Apr 14 13:29:01 [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed
$ORIGIN .
firewall-int.my.domain. 3600	IN	A	10.0.1.1
my.domain	3600	IN	NS	ns1.my.domain.
my.domain	3600	IN	SOA	a.misconfigured.dns.server.invalid hostmaster.my.domain 0 10800 3600 604800 3600

The OS I am running is:

PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

The versions of pdns:

sudo systemctl status pdns && sudo systemctl status pdns-recursor
● pdns.service - PowerDNS Authoritative Server
     Loaded: loaded (/lib/systemd/system/pdns.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2025-04-14 12:57:35 UTC; 33min ago
       Docs: man:pdns_server(1)
             man:pdns_control(1)
             https://doc.powerdns.com
   Main PID: 31467 (pdns_server)
      Tasks: 8 (limit: 9477)
     Memory: 43.2M
        CPU: 121ms
     CGroup: /system.slice/pdns.service
             └─31467 /usr/sbin/pdns_server --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no

Apr 14 12:57:35 dns01 pdns_server[31467]: [bindbackend] Done parsing domains, 0 rejected, 0 new, 0 removed
Apr 14 12:57:35 dns01 pdns_server[31467]: UDP server bound to 127.0.0.1:5300
Apr 14 12:57:35 dns01 pdns_server[31467]: TCP server bound to 127.0.0.1:5300
Apr 14 12:57:35 dns01 pdns_server[31467]: PowerDNS Authoritative Server 4.5.3 (C) 2001-2021 PowerDNS.COM BV
Apr 14 12:57:35 dns01 pdns_server[31467]: Using 64-bits mode. Built using gcc 11.2.0.
Apr 14 12:57:35 dns01 pdns_server[31467]: PowerDNS comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redist>
Apr 14 12:57:35 dns01 pdns_server[31467]: Creating backend connection for TCP
Apr 14 12:57:35 dns01 pdns_server[31467]: About to create 3 backend threads for UDP
Apr 14 12:57:35 dns01 systemd[1]: Started PowerDNS Authoritative Server.
Apr 14 12:57:35 dns01 pdns_server[31467]: Done launching threads, ready to distribute questions
● pdns-recursor.service - PowerDNS Recursor
     Loaded: loaded (/lib/systemd/system/pdns-recursor.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2025-04-14 12:47:46 UTC; 43min ago
       Docs: man:pdns_recursor(1)
             man:rec_control(1)
             https://doc.powerdns.com
   Main PID: 31417 (pdns_recursor)
      Tasks: 5 (limit: 9477)
     Memory: 12.6M
        CPU: 1.068s
     CGroup: /system.slice/pdns-recursor.service
             └─31417 /usr/sbin/pdns_recursor --daemon=no --write-pid=no --disable-syslog --log-timestamp=no

Apr 14 12:47:46 dns01 pdns-recursor[31417]: Inserting rfc 1918 private space zones
Apr 14 12:47:46 dns01 pdns-recursor[31417]: Listening for UDP queries on 10.0.2.11:53
Apr 14 12:47:46 dns01 pdns-recursor[31417]: Enabled TCP data-ready filter for (slight) DoS protection
Apr 14 12:47:46 dns01 pdns-recursor[31417]: Listening for TCP queries on 10.0.2.11:53
Apr 14 12:47:46 dns01 pdns-recursor[31417]: Launching 1 distributor threads
Apr 14 12:47:46 dns01 pdns-recursor[31417]: Launching 2 worker threads
Apr 14 12:47:46 dns01 systemd[1]: Started PowerDNS Recursor.
Apr 14 12:47:46 dns01 pdns-recursor[31417]: Done priming cache with root hints
Apr 14 12:47:46 dns01 pdns-recursor[31417]: Enabled 'epoll' multiplexer
Apr 14 12:47:46 dns01 pdns-recursor[31417]: Refreshed . records

[HachimanSec]

sudo nano /etc/powerdns/recursor.conf
#################################
# forward-zones Zones for which we forward queries, comma separated domain=ip pairs
#
forward-zones=my.domain=127.0.0.1:5300

#################################
# local-address IP addresses to listen on, separated by spaces or commas. Also accepts ports.
#
local-address=10.0.2.11

#################################
# local-port    port to listen on
#
local-port=53

[Habbie]

sudo: pdnsutil edit-zone: command not found

this is very weird. Why would sudo take that space as part of the command name? Is there a weird character in there?

sudo -u pdns pdnsutil create-zone my.domain ns1.my.domain

is that the real domain name? If not, please replace your pastes with real output. See https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open

Apr 14 12:57:35 dns01 pdns_server[31467]: UDP server bound to 127.0.0.1:5300

that's not port 53, which explains your dig failure

[Habbie]

try dig +cd on the Recursor. If that helps, read the Warning at https://doc.powerdns.com/recursor/yamlsettings.html?highlight=forward%20zones#recursor-forward-zones

[HachimanSec]

it still resolved to CF instead of the 127.0.0.1:5300 that is defined in the recursor.conf.
I don't see anything related to BOGUS as mentioned in the warning.

dig +cd firewall.my.domain

; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> +cd firewall.my.domain
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60347
;; flags: qr rd ra ad cd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;firewall.my.domain.		IN	A

;; AUTHORITY SECTION:
m.		180.domainy0	IN	SOA	alberto.ns.cloudflare.com. dns.cloudflare.com. 2369265634 10000 2400 604800 1800

;; Query time: 16 msec
;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
;; WHEN: Mon Apr 14 13:53:56 UTC 2025
;; MSG SIZE  rcvd: 116

[HachimanSec]

this is the current recursor.conf

#################################
# forward-zones Zones for which we forward queries, comma separated domain=ip pairs
#
forward-zones=my.domain=127.0.0.1:5300

[HachimanSec]

I apparently had a confusion about which resolver is used. it works now.

[miodvallat]

And the second problem is that edit-zone doesnt work - even though I have $EDITOR and the default editor in sudoers file (nano):

sudo -u pdns pdnsutil edit-zone my.domain
sudo: pdnsutil edit-zone: command not found

This looks like the space between pdnsutil and edit-zone is not a regular whitespace but something else (maybe a non-breaking space?), so sudo is trying to run a non-existent pdnsutil edit-zone command.

[HachimanSec]

Oh man, thank you. you are so right. it was a wrong char when I copied it from the website. I can confirm the command works!