PowerDNS Recursor - Caching DNS Resolver

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

PowerDNS Recursor is a high performance, standards compliant open source recursive DNS resolver. Unlike an authoritative server, which publishes the zones you own, a recursor resolves names on behalf of your clients: it walks the DNS hierarchy from the root servers down, follows delegations, validates answers, and caches the results so repeat lookups are answered instantly. It is the resolver you point your workloads, containers and office networks at instead of a public resolver, keeping your DNS traffic private and under your control. This image delivers PowerDNS Recursor fully installed, hardened and ready to resolve within minutes of launch, so you skip hours of manual resolver setup and lock down.

Why choose this over a managed resolver: unlike AWS Route 53 Resolver, PowerDNS Recursor gives you full Lua policy scripting, RPZ based DNS firewalling with your own threat feeds, and granular cache and rate limit tuning you control entirely. Unlike a bare Unbound image, this build ships a complete REST API, first boot per instance credential isolation, and a hardened systemd service already configured. You get the flexibility of self hosted DNS with production grade security defaults.

Secure by default, never an open resolver: the shipped configuration restricts recursion to loopback and the RFC1918 private address ranges only. Queries from arbitrary internet sources are refused, so this instance can never be abused as a DNS amplification reflector. Opening the resolver to your own client subnets is a single documented configuration change, and the user guide walks you through it.

Application stack: PowerDNS Recursor runs as a hardened systemd service answering DNS on port 53 over both UDP and TCP for allowed clients. Its REST API and status webserver bind to loopback on port 8082 and are authenticated with a per instance API key and webserver password, so the management surface is never exposed to the network while DNS resolution serves your private networks. The systemd-resolved stub listener is disabled so the Recursor owns port 53 cleanly, and the operating system continues to resolve names through the upstream resolver list.

No default or shared credentials ship in the image. On the first boot of your instance a one shot service generates a unique REST API key and a unique webserver password, writes them to a root only file, starts the resolver, and verifies both that the API key round trips and that a real recursive query resolves before completing. The API rejects unauthenticated requests.

Key capabilities: high performance recursive resolution with an in memory cache; DNSSEC validation of signed zones; query and response rate limiting and packet cache tuning; a full REST API for metrics, cache management and configuration; Lua scripting hooks for policy, filtering and response modification; and RPZ (Response Policy Zone) support for DNS firewalling and threat blocking.

Get started: retrieve the per instance REST API key from the root only credentials file, add your own client subnets to allow-from, then point your workloads and networks at this instance for DNS resolution. cloudimg engineers can walk you through client access control, DNSSEC validation, RPZ threat filtering and Lua policy scripting after purchase.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.