PowerDNS Recursor on Ubuntu 24.04 LTS
by cloudimg
PowerDNS Recursor on Ubuntu 24.04, a caching recursive resolver, secure by default not an open resolver
PowerDNS Recursor is a high performance, standards compliant open source recursive DNS resolver developed by PowerDNS.COM BV. Unlike an authoritative server, which publishes the zones you own, a recursor resolves names on behalf of your clients: it walks the DNS hierarchy from the root servers down, follows delegations, validates DNSSEC signed answers, and caches results so repeat lookups are answered instantly. This cloudimg image runs PowerDNS Recursor 5.3 from the official PowerDNS packages on Ubuntu 24.04 LTS, hardened and ready to resolve within minutes of launch.
Secure by default, never an open resolver. The shipped configuration restricts recursion to loopback and the RFC1918 private address ranges only. Queries from arbitrary internet sources are refused, so this instance can never be abused as a DNS amplification reflector. Opening the resolver to your own client subnets is a single documented configuration change.
Security is built in. No default or shared credentials ship in the image: on first boot every VM generates a unique REST API key and a unique webserver password, writes them to a root only file, starts the resolver, and verifies both that the API key round trips and that a real recursive query resolves before completing. The REST API and status webserver are bound to loopback only, so the management surface is never exposed to the network while DNS resolution serves your private networks. DNSSEC validation, RPZ response policy zones for DNS firewalling, Lua scripting and a full REST API for metrics and cache management are all available.
PowerDNS Recursor is distributed under the GNU General Public License version 2 with an OpenSSL linking exception, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by PowerDNS.COM BV; PowerDNS is a mark of its owner. cloudimg provides packaging, the secure by default configuration, per instance credential automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.