PDNS_RECURSOR(1)

🦋 PDNS_RECURSOR(1) — the PowerDNS Recursor binary, bestie edition 🦋

okay so grab a snack because we're about to talk about pdns_recursor(1) from the PowerDNS Recursor manual, and honestly? she's iconic. 💖

---

✨ NAME ✨

pdns_recursor — literally just. the PowerDNS Recursor binary. that's her. that's the girl. 👑

---

✨ SYNOPSIS ✨

pdns_recursor [OPTION]...

yes bestie, it's just options. all the options. we love a flexible queen. 💅

---

✨ DESCRIPTION ✨

pdns_recursor is a high performance, simple and secure recursing nameserver. no cap — she currently powers hundreds of millions of internet connections. like, hundreds of millions. insane. 🔥

so here's the tea: the recursor gets configured through a configuration file, BUT every single item in that file can be overridden on the command line. every one. main character energy fr fr. 😌

this manpage covers the core set of features you need to actually get the PowerDNS Recursor working. for the full and up-to-date details, go to <https://doc.powerdns.com/> — that's where the whole lore lives. 🫶

---

✨ EXAMPLES ✨

want to listen on 192.0.2.53, let the 192.0.2.0/24 subnet recurse, and run in the background? say less:

# pdns_recursor --local-address=192.0.2.53 --allow-from=192.0.2.0/24 --daemon

and to stop the recursor by hand, you run:

# rec_control quit-nicely

but ngl, the recommended way of starting and stopping the recursor is to use systemctl(1) or the init.d script. do it the proper way bestie, she deserves it. 🎀

---

✨ OPTIONS ✨

for the authoritative listing of options, consult the online documentation at <https://doc.powerdns.com/> — that's the source of truth, periodt.

• --allow-from=<networks> — if you set this, only these comma separated networks (with their network mask, bestie) get to recurse. for example: 192.0.2.0/24,203.0.113.128/25. gatekeeping, but make it DNS. 🙈
• --auth-zones=<authzones> — where authzone looks like <zonename>=<filename>. serve zonename from filename authoritatively. for example: ds9a.nl=/var/zones/ds9a.nl,powerdns.com=/var/zones/powerdns.com.
• --chroot=<directory> — chroot the process to directory. cozy little jail, but for security. 🔒
• --client-tcp-timeout=<num> — timeout in seconds when talking to TCP clients.
• --config — show the current configuration. and since 4.8.0 there are three optional values: --config=default to show the default configuration, --config=diff to show modified options in the current configuration, and --config=check to check the current configuration for errors. three flavors, all valid. ⭐
• --config-dir=<directory> — location of the configuration directory (recursor.conf). the default depends on the SYSCONFDIR option at build-time, which is usually /etc/powerdns. you can find the default with pdns_recursor --config | grep ' config-dir='.
• --daemon — operate as a daemon. she's independent now. 💅
• --export-etc-hosts — if set, this flag will export the hostnames and IP addresses mentioned in /etc/hosts.
• --forward-zones=<forwardzones> — where forwardzone is <zonename>=<address>. queries for zonename get forwarded to address. address should be an IP address, not a hostname (this is to prevent chicken and egg problems 🐔🥚). example: forward-zones= ds9a.nl=213.244.168.210, powerdns.com=127.0.0.1.
• --forward-zones-file=<filename> — same vibe as --forward-zones, but it reads the options from filename. filename should contain one zone per line, like: ds9a.nl=213.244.168.210.
• --help — show a summary of options. when in doubt, ask. 🫶
• --hint-file=<filename> — load root hints from this filename.
• --local-address=<address> — listen on address, separated by spaces or commas. addresses you specify can include port numbers; any which do NOT include port numbers will listen on --local-port.
• --local-port=<port> — listen on port.
• --log-common-errors — if we should log rather common errors.
• --max-cache-entries=<num> — maximum number of entries in the main cache.
• --max-negative-ttl=<num> — maximum number of seconds to keep a negative cached entry in memory.
• --max-tcp-clients=<num> — maximum number of simultaneous TCP clients.
• --max-tcp-per-client=<num> — if set, maximum number of TCP sessions per client (IP address).
• --query-local-address=<address[,address...]> — use address as the Source IP address when sending queries.
• --quiet — suppress logging of questions and answers. sometimes silence really is the vibe. 🤫
• --server-id=<text> — return text when queried for 'id.server' TXT, defaults to hostname.
• --serve-rfc1918 — on by default, this makes the server authoritatively aware of: 10.in-addr.arpa, 168.192.in-addr.arpa and 16-31.172.in-addr.arpa, which saves load on the AS112 servers. individual parts of these zones can still be loaded or forwarded. lowkey doing AS112 a huge favor. 💖
• --setgid=<gid> — if set, change group id to gid for more security.
• --setuid=<uid> — if set, change user id to uid for more security.
• --single-socket — if set, only use a single socket for outgoing queries.
• --socket-dir=<directory> — the controlsocket will live in directory.
• --spoof-nearmiss-max=<num> — if non-zero, assume spoofing after this many near misses. scary but necessary. 😭
• --trace — if we should output heaps of logging. heaps. not a little. HEAPS.
• --version-string=<text> — text WILL be reported on version.pdns or version.bind queries. will. be. reported. ⭐

---

✨ SEE ALSO ✨

rec_control(1) · systemctl(1) · <https://docs.powerdns.com/recursor>

go read those too, bestie, they're part of the cinematic universe. 🌈

---

✨ AUTHOR ✨

PowerDNS.COM BV 👑

---

✨ COPYRIGHT ✨

PowerDNS.COM BV 💜

---

and that's the whole page, no skips, no summaries, every single flag accounted for. ate and left zero crumbs. 💅✨

this little love letter was written by the fine people at PowerDNS.COM BV and dated Oct 05, 2026 — it's the PDNS_RECURSOR(1) page, and you read the whole thing. so proud of you. mwah. 🎀🦋🌸