PowerDNS Authoritative Server on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of PowerDNS Authoritative Server on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. PowerDNS Authoritative Server is a high performance open source authoritative DNS server developed by PowerDNS.COM BV. It hosts the DNS zones for your own domains and answers queries for them, storing its zones and records in a relational database so you can manage DNS with SQL, the pdnsutil command line tool, or a full REST API.

The image installs PowerDNS Authoritative Server 5.1 from the official PowerDNS packages (the repo.powerdns.com auth 51 stable branch), pinned above the distribution package, against a MariaDB database backend on the same instance. Unattended security upgrades are configured to keep the server patched on your running VM.

Authoritative, not recursive. This server is authoritative for the zones you host: it publishes your DNS records to the internet. It is not a recursive resolver, so a query for a name it is not authoritative for is answered without recursion. This is the correct, safe role for a public facing name server and avoids the open resolver DNS amplification risk entirely.

Security by design — no default credentials. The REST API key is the equivalent of an administrator password for the DNS server, so this image never ships a fixed key. On the very first boot of every VM a fresh per instance REST API key and a fresh database password are generated, the demonstration zone is provisioned, and the details are written to /root/powerdns-credentials.txt (mode 0600, root only). The REST API and status webserver are bound to 127.0.0.1 only, so the management surface is never exposed to the network while DNS itself answers on port 53.

What is included:

• PowerDNS Authoritative Server 5.1 from the official PowerDNS packages, run under systemd as the unprivileged pdns user (pdns.service)

• A MariaDB database backend (gmysql) holding your zones and records, so you manage DNS with SQL, pdnsutil, or the REST API

• The REST API enabled and bound to loopback (127.0.0.1:8081), authenticated with a per instance X-API-Key, plus the status webserver

• One demonstration zone (example.com) so dig @<server> www.example.com resolves out of the box, ready for you to replace with your own domain

• A per instance REST API key and database password generated on first boot, documented in /root/powerdns-credentials.txt (0600)

• Built in DNSSEC signing available through pdnsutil, and the systemd-resolved stub listener disabled so PowerDNS owns port 53 cleanly

Prerequisites

• Active Azure subscription, SSH public key, VNet + subnet in target region

• Subscription to the PowerDNS Authoritative Server listing on Azure Marketplace

• Network Security Group rules allowing TCP 22 (admin) and both UDP and TCP 53 (DNS) from the clients that will query the server

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) for a small authoritative server. Servers answering heavy query volumes should use Standard_D2s_v5 or larger.

Step 1: Deploy from the Azure Portal

Search PowerDNS Authoritative Server in Marketplace, select the cloudimg publisher, and click Create. Configure the Network Security Group to allow UDP 53 and TCP 53 (DNS) from your client networks, and TCP 22 for administration. DNS uses UDP 53 for most queries and falls back to TCP 53 for large responses and zone transfers, so open both. The REST API stays on loopback and is never exposed.

Step 2: Deploy from the Azure CLI

RG="dns-prod"; LOCATION="eastus"; VM_NAME="ns1"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/powerdns-authoritative-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 53 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

Step 3: First boot

On first boot the image generates a fresh per instance REST API key and database password, provisions the demonstration example.com zone, starts pdns, verifies the API key round trips and the zone resolves, and writes /root/powerdns-credentials.txt. This completes within a minute. SSH in as azureuser and read the details:

sudo cat /root/powerdns-credentials.txt

Step 4: Confirm the services are running

pdns.service (the PowerDNS daemon) and mariadb.service (the database backend) are both active. ss confirms DNS is listening on :53 (UDP and TCP, all interfaces) while the REST API is bound to 127.0.0.1:8081 only.

systemctl is-active pdns.service mariadb.service
pdns_server --version
ss -tlnup | grep -E ':53 |:8081 '

Step 5: Query the demonstration zone

The image ships one demonstration zone, example.com, so a DNS round trip works immediately. Query it against the loopback address (or the VM public IP from a client). The aa flag in the header confirms an authoritative answer, and the demonstration records use the 203.0.113.10 documentation address, which you replace with your own.

dig @127.0.0.1 www.example.com
dig @127.0.0.1 example.com SOA +short
dig @127.0.0.1 example.com NS +short

Step 6: Use the REST API

The REST API is the same interface used by web control panels and automation tools. Read your per instance API key from the credentials file into a shell variable, then call the server info endpoint. It is bound to loopback, so run these on the VM (or tunnel port 8081 over SSH).

API_KEY=$(sudo grep '^powerdns.api.key=' /root/powerdns-credentials.txt | cut -d= -f2-)
curl -s -H "X-API-Key: $API_KEY" http://127.0.0.1:8081/api/v1/servers/localhost | jq .
pdnsutil list-all-zones

A request without the key is rejected with HTTP 401, and a request with the key returns HTTP 200:

API_KEY=$(sudo grep '^powerdns.api.key=' /root/powerdns-credentials.txt | cut -d= -f2-)
echo -n 'with key    : HTTP '; curl -s -o /dev/null -w '%{http_code}\n' -H "X-API-Key: $API_KEY" http://127.0.0.1:8081/api/v1/servers/localhost
echo -n 'without key : HTTP '; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8081/api/v1/servers/localhost

Step 7: Review the secure by default configuration

No default or shared credentials ship in the image. The credentials file is 0600 root:root, the API key and database password are unique to this VM, the backend is MariaDB (gmysql), and the REST API is bound to loopback only.

sudo stat -c '%n %a %U:%G' /root/powerdns-credentials.txt
grep -E 'launch|gmysql-dbname|webserver-address|api=' /etc/powerdns/pdns.d/cloudimg-pdns.conf
dig @127.0.0.1 example.com A +short

Step 8: Add your own authoritative zone

Replace the demonstration zone with your own domain. Create the zone and add records with pdnsutil. Because the zone list cache is disabled on this appliance, new zones and records are served immediately, no reload required.

pdnsutil zone create <your-domain>
pdnsutil rrset add <your-domain> <your-domain> NS 3600 "ns1.<your-domain>."
pdnsutil rrset add <your-domain> www A 3600 "203.0.113.20"
pdnsutil rrset add <your-domain> @ A 3600 "203.0.113.20"
pdnsutil zone list <your-domain>
dig @127.0.0.1 www.<your-domain>
# once your own <your-domain> zone resolves, remove the demonstration zone:
pdnsutil zone delete example.com

Step 9: Manage records with the REST API

You can also create zones and records through the REST API, which is how automation and control panels drive PowerDNS. This example creates a zone with a single POST:

API_KEY=$(sudo grep '^powerdns.api.key=' /root/powerdns-credentials.txt | cut -d= -f2-)
curl -s -H "X-API-Key: $API_KEY" -H 'Content-Type: application/json' \
  -X POST http://127.0.0.1:8081/api/v1/servers/localhost/zones \
  -d '{"name":"<your-domain>.","kind":"Native","nameservers":["ns1.<your-domain>."]}'

Step 10: Enable DNSSEC signing

PowerDNS signs zones with a single command. Secure your zone, then publish the DS record it prints at your registrar so resolvers can validate your answers.

pdnsutil secure-zone <your-domain>
pdnsutil show-zone <your-domain>
pdnsutil export-zone-ds <your-domain>

Step 11: Delegate your domain

Point your domain registrar's name server (NS) records at this VM's public IP so the internet queries this server for your zone. Confirm from an external client:

dig @<public-ip> www.<your-domain>

For resilience, run a second PowerDNS instance as a secondary and scope zone transfers (AXFR) to its address with the allow-axfr-ips setting or per zone ALLOW-AXFR-FROM metadata.

Step 12: Security recommendations

• Restrict the NSG. Allow UDP and TCP 53 only from the client networks that need to query the server, and TCP 22 for administration only. The REST API stays on loopback; tunnel port 8081 over SSH if you need it remotely.

• Keep the REST API on loopback. The image binds the API and status webserver to 127.0.0.1 and sets webserver-allow-from to loopback. Do not expose it directly; front it with a reverse proxy and TLS if remote API access is required.

• Enable DNSSEC for production zones (Step 10) so resolvers can validate your answers.

• Add secondary servers and scope AXFR zone transfers to their addresses rather than leaving them open.

• Keep the OS and PowerDNS patched. Unattended security upgrades remain enabled on the running VM, including the official PowerDNS repository for the auth 51 branch.

• Back up the database. Your zones and records live in the MariaDB powerdns database; take regular mysqldump backups.

Step 13: Support and Licensing

PowerDNS Authoritative Server is developed by PowerDNS.COM BV and distributed under the GNU General Public License version 2 (GPL-2.0) with an OpenSSL linking exception (see the upstream NOTICE file). This cloudimg image bundles the unmodified official PowerDNS packages. cloudimg provides the packaging, the MariaDB backend integration, the per instance credential automation, the demonstration zone, and 24/7 support with a guaranteed 24 hour response SLA.

cloudimg is not affiliated with or endorsed by PowerDNS.COM BV. PowerDNS is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find PowerDNS Authoritative Server on Ubuntu 24.04 LTS on the Azure Marketplace, published by cloudimg. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email support@cloudimg.co.uk for deployment help, configuration questions, or licensing enquiries.