I've got two freshly configured PowerDNS servers. One acts as a master, the second one as a slave. There are two daemons running on each of them: powerdns and powerdns-recursor. The first one binds to 5300 tcp port, the second one to 53. I added the following rules to recursor.conf (126.96.36.199 is the IP address of the server):
Thanks to them my servers resolve domains which are added internally as well as external domains like google.com. The only problem is that if I allow only my local IP addresses to send recursive queries, the internally added domains won't be reachable from the world. On the other hand, if I set the
allow-from parameter to 0.0.0.0/0 in recursor.conf, my servers will be vulnerable to the DNS Amplification attacks. What should I do? I want to allow all IPs to query my servers for domains that they have the authority over, but disallow recursive queries.