IXFRDIST.YML(5)

📦
version 5.1.4 · 10 versions
, in ubuntu stonking

🎀 IXFRDIST.YML 🎀

okay so this is the manual page for ixfrdist.yml(5) from the PowerDNS Authoritative Server — it's the little config file that runs the whole ixfrdist show, and bestie, we're going to go through every single line of it together 💖

✨ NAME ✨

ixfrdist.yml — the ixfrdist configuration file. that's it, that's the name, she's simple and she knows it 🫶

✨ SYNOPSIS ✨

ixfrdist.yml

just the file. that's the whole synopsis. iconic minimalism 💅

✨ DESCRIPTION ✨

so here's the tea: ixfrdist reads its configuration from a YAML file. by default this file is called ixfrdist.yml, and it gets read from the directory that was configured as SYSCONFDIR back when the software was built. that directory is usually one of /etc/pdns or /etc/powerdns, but don't just trust me on vibes — if you wanna see the actual default, run ixfrdist --help and it'll spill 🌸

✨ EXAMPLE ✨

here's a full little example config, no cap, copy-adjacent energy:

listen:
  - 192.0.2.2
  - '[2001:DB8:ABCD::2]:5300'
  - 127.0.0.1

acl:
  - 127.0.0.1
  - '192.0.2.0/24'
  - '2001:DB8:ABCD:1234::/64'

work-dir: /var/lib/ixfrdist

uid: ixfrdist
gid: ixfrdist

domains:
  - domain: example.com
    master: 192.0.2.18:5301
    max-soa-refresh: 1800
    notify:
      - 192.0.3.1
      - 192.0.3.2:5301
  - domain: example.net
    master: 2001:DB8:ABCD::2

💖 OPTIONS 💖

the main character section. every option, in order, let's gooo 👑

  • listen — the list of addresses to listen on. ixfrdist listens on both TCP and UDP, she's doing both, she contains multitudes ✨. when you don't specify a port, port 53 is used. when you're specifying ports for IPv6, use the "bracket" notation. by default, ixfrdist listens on 127.0.0.1:53 and [::1]:53.
  • acl — a list of netmasks that are allowed to query ixfrdist and request AXFRs and IXFRs. entries without a netmask get interpreted as a single address. by default, the ACL is set to 127.0.0.0/8 and ::1/128. so like, your localhost is automatically in the club 🪩
  • axfr-max-records — maximum number of records allowed in an AXFR transaction requested by ixfrdist. this is your lil guard rail so untrusted sources can't just inhale all the process memory 😭. by default this setting is 0, which means "unlimited".
  • axfr-timeout — timeout in seconds that an AXFR transaction requested by ixfrdist is allowed to take. crank this up if the network to the authoritative servers is slow, or if your domains are absolute units and you keep getting timeouts. defaults to 20.
  • failed-soa-retry — time in seconds between retries of the SOA query for a zone we have never transferred. defaults to 30.
  • compress — whether record compression should be enabled, which gives you smaller answers but costs more CPU and memory. it's giving tradeoff, bestie. defaults to false.
  • work-dir — the directory where the domain data is stored. if you don't set it, the current working directory is used. this working directory has the following structure: work-dir/ZONE/SERIAL, like for example work-dir/rpz.example./2018011902. honestly? highly recommended to set this option, because the current working directory might change between invocations and then everything goes sideways 🙈. also, this directory must be writable for the user or group that ixfrdist runs as.
  • keep — the amount of older copies / IXFR diffs to keep for every domain. defaults to 20.
  • tcp-in-threads — number of threads to spawn for TCP connections (AXFRs) from downstream hosts. this limits how many concurrent AXFRs to clients you can have going at once. set to 10 by default.
  • gid — group name or numeric ID to drop privileges to after binding the listen sockets. by default, ixfrdist runs as the user that started the process.
  • uid — user name or numeric ID to drop privileges to after binding the listen sockets. by default, ixfrdist runs as the user that started the process.
  • domains — a list of domains to redistribute. this option is mandatory, no skipping it, periodt.
    • domain — the domain name to transfer from the master. Mandatory.
    • master — IP address of the server to transfer this domain from. Mandatory.
    • max-soa-refresh — cap the refresh time to the given maximum (in seconds). Optional.
    • notify — the list of destinations to send NOTIFY to. Optional.
  • webserver-address — IP address to listen on for the built-in webserver. when it's not set, no webserver is started at all, so like, no address no party 🎈
  • webserver-acl — a list of networks that are allowed to access the ixfrdist webserver. entries without a netmask will be interpreted as a single address. by default, this list is set to 127.0.0.0/8 and ::1/128.
  • webserver-loglevel — how much the webserver should log: 'none', 'normal' or 'detailed'. when logging happens, each log-line contains the UUID of the request, which lets you find errors caused by certain requests — super handy, iykyk 🔍. with 'none', nothing is logged except for errors. with 'normal' (which is the default), one line per request is logged in the style of the common log format:
[NOTICE] [webserver] 46326eef-b3ba-4455-8e76-15ec73879aa3 127.0.0.1:57566 "GET /metrics HTTP/1.1" 200 1846

and with 'detailed', the full requests and responses (including headers) are logged along with the regular log-line from 'normal' 📝

🌈 SEE ALSO 🌈

💜 AUTHOR 💜

PowerDNS.COM BV

PowerDNS.COM BV

and that's the whole page, bestie — you're officially fluent in ixfrdist.yml 🦋✨ this gorgeous thing came to you from the PowerDNS Authoritative Server, dated Aug 05, 2026, brought to you by PowerDNS.COM BV (same legends who wrote it, love that for them 💖). now go forth and configure responsibly 🌸💅

📦 where this page comes from