NPROXY(1)

💖 NPROXY(1) — the PowerDNS Authoritative Server bestie 💖

okay so. this is nproxy, aka the DNS notification proxy, part of the PowerDNS Authoritative Server crew. she's small, she's simple, she's a daemon, and she is literally the group chat relay for DNS NOTIFY queries. let's get into it 🫶

---

✨ SYNOPSIS ✨

nproxy --powerdns-address ADDRESS [OPTION]... ADDRESS...

like yes bestie, you do have to give her the --powerdns-address ADDRESS, and then the rest of the [OPTION]... situation, and then the trailing ADDRESS... pile. she's not picky about much but she is picky about that first one. 💅

---

🌸 DESCRIPTION 🌸

so here's the vibe: nproxy is a simple daemon that reads DNS NOTIFY queries on one address and forwards them to an 'inner' nameserver that will process the notification. that's it. that's the whole job. she reads, she forwards, she goes back to vibing. ✨

the usecase is giving "private authoritative server inside a NAT or firewalled LAN" — where nproxy is deployed in the DMZ. so the inner server gets to stay cosy and hidden behind the walls, and nproxy is the one out there being the main character in the DMZ. 🌈

now, the PowerDNS Authoritative Server has a trusted-notification-proxy option, and bestie, you should set that to the address set with --origin-address so it will accept these proxied notifications. it's giving "trust this specific friend, not the whole party." 🎀

nproxy also has a health-check option built in. here's the tea:

• a query for pdns.nproxy. with QType TXT will be responded to with an answer of "OK" (inside the TXT record).
• when the query is for an A-record, 1.2.3.4. is returned.

so she's healthy, she's responsive, she's answering the vibe check. ✅

---

👑 OPTIONS 👑

• --powerdns-address <ADDRESS> — IP address of the PowerDNS server to forward the notifications to. this is the one she needs, the whole point, the moment. 🌟
• --chroot <PATH> — chroot to PATH for additional security. lock her in a lil room, she doesn't mind, it's for safety. 🔒
• --setuid <UID> — setuid to this numerical UID.
• --setgid <GID> — setgid to this numerical GID.
• --origin-address <ADDRESS> — set the source of the notifications sent to PowerDNS to ADDRESS. by default, the best matching address (kernel's choice) is used. so if you don't pick, the kernel just picks for you, which is lowkey fine but you know. 👀
• --listen-address <ADDRESS> — IP addresses to listen on.
• --listen-port <PORT> — source port to listen on, 53 by default.
• -d, --daemon <ARG> — set ARG to 0 to disable running in the background. so like, foreground mode. right here with you. 🙈
• -v, --verbose — be verbose. give us the details, we love a yapper. 🗣️💬

---

🦋 AUTHOR 🦋

PowerDNS.COM BV ✨

---

💜 COPYRIGHT 💜

PowerDNS.COM BV

---

reminder bestie: don't forget that trusted-notification-proxy thing on the PowerDNS side, set it to your --origin-address value, or the notifications are just gonna get turned away at the door. no cap. 🚪😭

---

and that's the whole page, we ate, no crumbs left. 🌸 this was PowerDNS Authoritative Server business, dated Aug 05, 2026 — mwah, periodt. 💅💖