| Arguments |
| 8bit-dns | no | Allow 8bit dns queries |
| allow-axfr-ips | 195.67.27.100 | Allow zonetransfers only to these subnets |
| allow-dnsupdate-from | 127.0.0.0/8,::1 | A global setting to allow DNS updates from these IP ranges. |
| allow-notify-from | 0.0.0.0/0,::/0 | Allow AXFR NOTIFY from these IP ranges. If empty, drop all incoming notifies. |
| allow-recursion | 127.0.0.1 | List of subnets that are allowed to recurse |
| allow-unsigned-notify | yes | Allow unsigned notifications for TSIG secured domains |
| allow-unsigned-supermaster | yes | Allow supermasters to create zones without TSIG signed NOTIFY |
| also-notify | | When notifying a domain, also notify these nameservers |
| any-to-tcp | yes | Answer ANY queries with tc=1, shunting to TCP |
| api | no | Enable/disable the REST API |
| api-key | | Static pre-shared authentication key for access to the REST API |
| api-logfile | /var/log/pdns.log | Location of the server logfile (used by the REST API) |
| api-readonly | no | Disallow data modification through the REST API when set |
| cache-ttl | 20 | Seconds to store packets in the PacketCache |
| carbon-interval | 30 | Number of seconds between carbon (graphite) updates |
| carbon-ourname | | If set, overrides our reported hostname for carbon stats |
| carbon-server | | If set, send metrics in carbon (graphite) format to this server |
| chroot | | If set, chroot to this directory for more security |
| config | no | Provide configuration file on standard output |
| config-dir | /etc/powerdns | Location of configuration directory (pdns.conf) |
| config-name | | Name of this virtual configuration - will rename the binary image |
| control-console | no | Debugging switch - don't use |
| daemon | no | Operate as a daemon |
| default-ksk-algorithms | ecdsa256 | Default KSK algorithms |
| default-ksk-size | 0 | Default KSK size (0 means default) |
| default-soa-edit | | Default SOA-EDIT value |
| default-soa-edit-signed | | Default SOA-EDIT value for signed zones |
| default-soa-mail | | mail address to insert in the SOA record if none set in the backend |
| default-soa-name | a.misconfigured.powerdns.server | name to insert in the SOA record if none set in the backend |
| default-ttl | 3600 | Seconds a result is valid if not set otherwise |
| default-zsk-algorithms | | Default ZSK algorithms |
| default-zsk-size | 0 | Default ZSK size (0 means default) |
| direct-dnskey | no | Fetch DNSKEY RRs from backend during DNSKEY synthesis |
| disable-axfr | yes | Disable zonetransfers but do allow TCP queries |
| disable-axfr-rectify | no | Disable the rectify step during an outgoing AXFR. Only required for regression testing. |
| disable-syslog | | Disable logging to syslog, useful when running inside a supervisor that logs stdout |
| disable-tcp | no | Do not listen to TCP queries |
| distributor-threads | 3 | Default number of Distributor (backend) threads to start |
| dname-processing | no | If we should support DNAME records |
| dnssec-key-cache-ttl | 30 | Seconds to cache DNSSEC keys from the database |
| dnsupdate | no | Enable/Disable DNS update (RFC2136) support. Default is no. |
| do-ipv6-additional-processing | yes | Do AAAA additional processing |
| domain-metadata-cache-ttl | 60 | Seconds to cache domain metadata from the database |
| edns-subnet-processing | no | If we should act on EDNS Subnet options |
| entropy-source | /dev/urandom | If set, read entropy from this file |
| experimental-lua-policy-script | | Lua script for the policy engine |
| forward-dnsupdate | yes | A global setting to allow DNS update packages that are for a Slave domain, to be forwarded to the master. |
| gmysql-activate-domain-key-query | update cryptokeys set active=1 where domain_id=(select id from domains where name=?) and cryptokeys.id=? | |
| gmysql-add-domain-key-query | insert into cryptokeys (domain_id, flags, active, content) select id, ?, ?, ? from domains where name=? | |
| gmysql-any-id-query | SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and name=? and domain_id=? | Any with ID query |
| gmysql-any-query | SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and name=? | Any query |
| gmysql-basic-query | SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and type=? and name=? | Basic query |
| gmysql-clear-domain-all-keys-query | delete from cryptokeys where domain_id=(select id from domains where name=?) | |
| gmysql-clear-domain-all-metadata-query | delete from domainmetadata where domain_id=(select id from domains where name=?) | |
| gmysql-clear-domain-metadata-query | delete from domainmetadata where domain_id=(select id from domains where name=?) and domainmetadata.kind=? | |
| gmysql-dbname | pdns | Pdns backend database name to connect to |
| gmysql-deactivate-domain-key-query | update cryptokeys set active=0 where domain_id=(select id from domains where name=?) and cryptokeys.id=? | |
| gmysql-delete-comment-rrset-query | DELETE FROM comments WHERE domain_id=? AND name=? AND type=? | |
| gmysql-delete-comments-query | DELETE FROM comments WHERE domain_id=? | |
| gmysql-delete-domain-query | delete from domains where name=? | |
| gmysql-delete-empty-non-terminal-query | delete from records where domain_id=? and name=? and type is null | delete empty non-terminal from zone |
| gmysql-delete-names-query | delete from records where domain_id=? and name=? | |
| gmysql-delete-rrset-query | delete from records where domain_id=? and name=? and type=? | |
| gmysql-delete-tsig-key-query | delete from tsigkeys where name=? | |
| gmysql-delete-zone-query | delete from records where domain_id=? | |
| gmysql-dnssec | no | Enable DNSSEC processing |
| gmysql-get-all-domain-metadata-query | select kind,content from domains, domainmetadata where domainmetadata.domain_id=domains.id and name=? | |
| gmysql-get-all-domains-query | select domains.id, domains.name, records.content, domains.type, domains.master, domains.notified_serial, domains.last_check, domains.account from domains LEFT JOIN records ON records.domain_id=domains.id AND records.type='SOA' AND records.name=domains.name WHERE records.disabled=0 OR ? | Retrieve all domains |
| gmysql-get-domain-metadata-query | select content from domains, domainmetadata where domainmetadata.domain_id=domains.id and name=? and domainmetadata.kind=? | |
| gmysql-get-order-after-query | select ordername from records where ordername > ? and domain_id=? and disabled=0 and ordername is not null order by 1 asc limit 1 | DNSSEC Ordering Query, after |
| gmysql-get-order-before-query | select ordername, name from records where ordername <= ? and domain_id=? and disabled=0 and ordername is not null order by 1 desc limit 1 | DNSSEC Ordering Query, before |
| gmysql-get-order-first-query | select ordername from records where domain_id=? and disabled=0 and ordername is not null order by 1 asc limit 1 | DNSSEC Ordering Query, first |
| gmysql-get-order-last-query | select ordername, name from records where ordername != '' and domain_id=? and disabled=0 and ordername is not null order by 1 desc limit 1 | DNSSEC Ordering Query, last |
| gmysql-get-tsig-key-query | select algorithm, secret from tsigkeys where name=? | |
| gmysql-get-tsig-keys-query | select name,algorithm, secret from tsigkeys | |
| gmysql-group | client | Pdns backend MySQL 'group' to connect as |
| gmysql-host | localhost | Database backend host to connect to |
| gmysql-id-query | SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and type=? and name=? and domain_id=? | Basic with ID query |
| gmysql-info-all-master-query | select id,name,master,last_check,notified_serial,type from domains where type='MASTER' | |
| gmysql-info-all-slaves-query | select id,name,master,last_check from domains where type='SLAVE' | |
| gmysql-info-zone-query | select id,name,master,last_check,notified_serial,type,account from domains where name=? | |
| gmysql-innodb-read-committed | yes | Use InnoDB READ-COMMITTED transaction isolation level |
| gmysql-insert-comment-query | INSERT INTO comments (domain_id, name, type, modified_at, account, comment) VALUES (?, ?, ?, ?, ?, ?) | |
| gmysql-insert-empty-non-terminal-order-query | insert into records (type,domain_id,disabled,name,ordername,auth,change_date,content,ttl,prio) values (null,?,0,?,?,?,NULL,NULL,NULL,NULL) | insert empty non-terminal in zone |
| gmysql-insert-record-query | insert into records (content,ttl,prio,type,domain_id,disabled,name,ordername,auth,change_date) values (?,?,?,?,?,?,?,?,?,NULL) | |
| gmysql-insert-zone-query | insert into domains (type,name,master,account,last_check,notified_serial) values(?,?,?,?,NULL,NULL) | |
| gmysql-list-comments-query | SELECT domain_id,name,type,modified_at,account,comment FROM comments WHERE domain_id=? | |
| gmysql-list-domain-keys-query | select cryptokeys.id, flags, active, content from domains, cryptokeys where cryptokeys.domain_id=domains.id and name=? | |
| gmysql-list-query | SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE (disabled=0 OR ?) and domain_id=? order by name, type | AXFR query |
| gmysql-list-subzone-query | SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE disabled=0 and (name=? OR name like ?) and domain_id=? | Subzone listing |
| gmysql-master-zone-query | select master from domains where name=? and type='SLAVE' | Data |
| gmysql-nullify-ordername-and-update-auth-query | update records set ordername=NULL,auth=? where domain_id=? and name=? and disabled=0 | DNSSEC nullify ordername and update auth for a qname query |
| gmysql-nullify-ordername-and-update-auth-type-query | update records set ordername=NULL,auth=? where domain_id=? and name=? and type=? and disabled=0 | DNSSEC nullify ordername and update auth for a rrset query |
| gmysql-password | s1lv3rpENGU!n | Pdns backend password to connect with |
| gmysql-port | 3306 | Database backend port to connect to |
| gmysql-remove-domain-key-query | delete from cryptokeys where domain_id=(select id from domains where name=?) and cryptokeys.id=? | |
| gmysql-remove-empty-non-terminals-from-zone-query | delete from records where domain_id=? and type is null | remove all empty non-terminals from zone |
| gmysql-search-comments-query | SELECT domain_id,name,type,modified_at,account,comment FROM comments WHERE name LIKE ? OR comment LIKE ? LIMIT ? | |
| gmysql-search-records-query | SELECT content,ttl,prio,type,domain_id,disabled,name,auth FROM records WHERE name LIKE ? OR content LIKE ? LIMIT ? | |
| gmysql-set-domain-metadata-query | insert into domainmetadata (domain_id, kind, content) select id, ?, ? from domains where name=? | |
| gmysql-set-tsig-key-query | replace into tsigkeys (name,algorithm,secret) values(?,?,?) | |
| gmysql-socket | | Pdns backend socket to connect to |
| gmysql-supermaster-name-to-ips | select ip,account from supermasters where nameserver=? and account=? | |
| gmysql-supermaster-query | select account from supermasters where ip=? and nameserver=? | |
| gmysql-timeout | 10 | The timeout in seconds for each attempt to read/write to the server |
| gmysql-update-account-query | update domains set account=? where name=? | |
| gmysql-update-kind-query | update domains set type=? where name=? | |
| gmysql-update-lastcheck-query | update domains set last_check=? where id=? | |
| gmysql-update-master-query | update domains set master=? where name=? | |
| gmysql-update-ordername-and-auth-query | update records set ordername=?,auth=? where domain_id=? and name=? and disabled=0 | DNSSEC update ordername and auth for a qname query |
| gmysql-update-ordername-and-auth-type-query | update records set ordername=?,auth=? where domain_id=? and name=? and type=? and disabled=0 | DNSSEC update ordername and auth for a rrset query |
| gmysql-update-serial-query | update domains set notified_serial=? where id=? | |
| gmysql-user | pdns | Database backend user to connect as |
| gmysql-zone-lastchange-query | select max(change_date) from records where domain_id=? | |
| guardian | no | Run within a guardian process |
| help | no | Provide a helpful message |
| include-dir | /etc/powerdns/pdns.d | Include *.conf files from this directory |
| launch | gmysql | Which backends to launch and order to query them in |
| list-modules | no | Lists all modules available |
| load-modules | | Load this module - supply absolute or relative path |
| local-address | 0.0.0.0 | Local IP addresses to which we bind |
| local-address-nonexist-fail | yes | Fail to start if one or more of the local-address's do not exist on this server |
| local-ipv6 | :: | Local IP address to which we bind |
| local-ipv6-nonexist-fail | yes | Fail to start if one or more of the local-ipv6 addresses do not exist on this server |
| local-port | 53 | The port on which we listen |
| log-dns-details | no | If PDNS should log DNS non-erroneous details |
| log-dns-queries | no | If PDNS should log all incoming DNS queries |
| logging-facility | | Log under a specific facility |
| loglevel | 4 | Amount of logging. Higher is more. Do not set below 3 |
| lua-prequery-script | | Lua script with prequery handler (DO NOT USE) |
| master | no | Act as a master |
| max-cache-entries | 1000000 | Maximum number of cache entries |
| max-ent-entries | 100000 | Maximum number of empty non-terminals in a zone |
| max-nsec3-iterations | 500 | Limit the number of NSEC3 hash iterations |
| max-queue-length | 5000 | Maximum queuelength before considering situation lost |
| max-signature-cache-entries | | Maximum number of signatures cache entries |
| max-tcp-connections | 20 | Maximum number of TCP connections |
| module-dir | /usr/lib/i386-linux-gnu/pdns | Default directory for modules |
| negquery-cache-ttl | 60 | Seconds to store negative query results in the QueryCache |
| no-config | no | Don't parse configuration file |
| no-shuffle | off | Set this to prevent random shuffling of answers - for regression testing |
| non-local-bind | no | Enable binding to non-local addresses by using FREEBIND / BINDANY socket options |
| only-notify | 0.0.0.0/0,::/0 | Only send AXFR NOTIFY to these IP addresses or netmasks |
| out-of-zone-additional-processing | yes | Do out of zone additional processing |
| outgoing-axfr-expand-alias | no | Expand ALIAS records during outgoing AXFR |
| overload-queue-length | 0 | Maximum queuelength moving to packetcache only |
| prevent-self-notification | yes | Don't send notifications to what we think is ourself |
| query-cache-ttl | 20 | Seconds to store query results in the QueryCache |
| query-local-address | 0.0.0.0 | Source IP address for sending queries |
| query-local-address6 | :: | Source IPv6 address for sending queries |
| query-logging | no | Hint backends that queries should be logged |
| queue-limit | 1500 | Maximum number of milliseconds to queue a query |
| receiver-threads | 1 | Default number of receiver threads to start |
| recursive-cache-ttl | 10 | Seconds to store packets for recursive queries in the PacketCache |
| recursor | no | If recursion is desired, IP address of a recursing nameserver |
| retrieval-threads | 2 | Number of AXFR-retrieval threads for slave operation |
| reuseport | no | Enable higher performance on compliant kernels by using SO_REUSEPORT allowing each receiver thread to open its own socket |
| security-poll-suffix | secpoll.powerdns.com. | Domain name from which to query security update notifications |
| server-id | aoeu | Returned when queried for 'server.id' TXT or NSID, defaults to hostname - disabled or custom |
| setgid | pdns | If set, change group id to this gid for more security |
| setuid | pdns | If set, change user id to this uid for more security |
| signing-threads | 3 | Default number of signer threads to start |
| slave | yes | Act as a slave |
| slave-cycle-interval | 60 | Schedule slave freshness checks once every .. seconds |
| slave-renotify | no | If we should send out notifications for slaved updates |
| soa-expire-default | 604800 | Default SOA expire |
| soa-minimum-ttl | 3600 | Default SOA minimum ttl |
| soa-refresh-default | 10800 | Default SOA refresh |
| soa-retry-default | 3600 | Default SOA retry |
| socket-dir | /var/run | Where the controlsocket will live, /var/run when unset and not chrooted |
| tcp-control-address | | If set, PowerDNS can be controlled over TCP on this address |
| tcp-control-port | 53000 | If set, PowerDNS can be controlled over TCP on this address |
| tcp-control-range | 127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fe80::/10 | If set, remote control of PowerDNS is possible over these networks only |
| tcp-control-secret | | If set, PowerDNS can be controlled over TCP after passing this secret |
| traceback-handler | yes | Enable the traceback handler (Linux only) |
| trusted-notification-proxy | | IP address of incoming notification proxy |
| udp-truncation-threshold | 1680 | Maximum UDP response size before we truncate |
| version | no | Output version and compilation date |
| version-string | powerdns | PowerDNS version in packets - full, anonymous, powerdns or custom |
| webserver | yes | Start a webserver for monitoring |
| webserver-address | 0.0.0.0 | IP Address of webserver to listen on |
| webserver-allow-from | 0.0.0.0/0,::/0 | Webserver access is only allowed from these subnets |
| webserver-password | | Password required for accessing the webserver |
| webserver-port | 8081 | Port of webserver to listen on |
| webserver-print-arguments | yes | If the webserver should print arguments |
| write-pid | no | Write a PID file |
| xfr-max-received-mbytes | 100 | Maximum number of megabytes received from an incoming XFR |