PowerDNS Recursor 5.4.7 + dnsdist on Ubuntu 24.04

This is a repackaged open source software product wherein additional charges apply for security hardening, secure-by-default configuration and per-instance setup.

Security-hardened DNS and NTP server AMIs, built, patched and ready to deploy on AWS

Each AMI is a repackaged open-source DNS or NTP product with security hardening, secure-by-default configuration and per-instance credentials generated on first boot, applied by cloudimg.

What cloudimg adds to every version

• Every image is built on a fully patched base with the latest security updates applied at build time.
• Where a product has a login, API key or TLS key (web consoles, DNS-over-TLS, NTS, rndc), credentials are generated uniquely on the first boot of each instance and written to a root-only file. No default login exists and no two instances share a secret.
• DNS, DNS-over-TLS and NTP ports stay closed in the security group until you open them to your own VPC or VPN ranges. Resolvers answer only loopback and private networks by default, so an instance is never an open resolver.

These defaults mean you launch a hardened, isolated instance with no shared secrets, reducing your attack surface from the first minute.

Included products

• AdGuard Home 0.107.79 with Unbound: network-wide ad and tracker blocking with a web console
• AdGuard Home 0.107.79: network-wide ad and tracker blocking with a web console
• BIND 9.20.30: authoritative and recursive DNS (ISC BIND 9)
• Chrony 4.5: NTP time server and client
• CoreDNS 1.14.7: a pluggable DNS server
• DDNS Updater 2.10.0: keeps dynamic DNS records current
• ntpd-rs 1.9.0: an NTP server with NTS, written in Rust
• Pi-hole 6.5: network-wide ad blocking DNS
• Poweradmin 4.3.6: a web panel for PowerDNS Authoritative Server
• PowerDNS Recursor 5.4.7 + dnsdist: a recursive resolver with dnsdist for DNS-over-TLS and HTTPS
• SmartDNS 48.4: a fast local DNS resolver
• Unbound 1.19.2: a validating, recursive, caching resolver
• Zonemaster 2026.1.2: tests a zone's DNS delegation

How to choose a version

• Network-wide ad blocking: Pi-hole or AdGuard Home (choose AdGuard Home with Unbound for private recursive lookups)
• Recursive resolver for your VPC or VPN: Unbound, PowerDNS Recursor with dnsdist, or SmartDNS
• Authoritative DNS for your zones: BIND, CoreDNS, or Poweradmin
• Accurate time for your fleet: Chrony or ntpd-rs (with NTS for authenticated time)
• DNS delegation testing: Zonemaster
• Dynamic DNS record updates: DDNS Updater

Getting started

1. Select the product and version from the Software version dropdown on the launch page.

2. Launch the instance into your VPC.

3. First-boot credential generation runs automatically: retrieve your unique credentials from the root-only file on the instance.

4. Open only the ports you need in your security group, scoped to your VPC or VPN CIDR ranges.

5. Access the web console (for products that include one) or begin configuring the service.

This listing is a collection of separate AMIs, one per product and version, chosen from the Software version dropdown at launch.

Support

cloudimg provides 24/7 technical support for every version in this listing by email and live chat, 365 days a year, with a 24-hour response SLA: support@cloudimg.co.uk. Whether you need help selecting the right AMI, retrieving first-boot credentials, or integrating a resolver into your VPC architecture, the support team is available to assist.

Trademarks

Pi-hole, AdGuard Home and the other product names are trademarks of their respective owners. cloudimg is not affiliated with or endorsed by any of them.