PowerDNS Recursor with dnsdist

Overview

This appliance pairs two PowerDNS components into one privacy focused resolver. PowerDNS Recursor is the recursive resolver: it answers queries on behalf of your clients by walking the DNS hierarchy from the root servers, following delegations, validating DNSSEC signatures and caching results so repeat lookups are instant. dnsdist sits in front of it as the DNS load balancer and TLS terminator, adding encrypted client transports, per client access control, live traffic visibility and rule based filtering. Clients can query over plain DNS on port 53, DNS over TLS on port 853, or DNS over HTTPS on port 443, and all three share one cache and one policy.

Common uses

• Private encrypted DNS for a VNet, keeping client lookups off public resolvers
• A DNS over TLS and DNS over HTTPS endpoint for laptops, phones and browsers
• A caching resolver with DNSSEC validation and rule based filtering for branch or lab networks

See it running

Real screenshots taken while testing this image against its deployment guide.