Trouble setting up Primary/Secondary with AutoSecondary

[Zibbp]

Hi,
I'm attempting to setup a primary/secondary setup with the secondary being an autosecondary but running into an issue when attempting to notify the secondary zone.

Env info:
Primary: d1.debug.com 192.168.100.50
Secondary: d2.debug.com 192.168.100.51

Primary (d1.debug.com)

allow-dnsupdate-from=0.0.0.0/0
dnsupdate=yes
include-dir=/etc/powerdns/pdns.d
launch=gmysql
local-port=54
log-dns-details=no
log-dns-queries=no
loglevel=5
default-soa-content=master.@ hostmaster.@ 0 1800 3600 604800 5400
gmysql-host=localhost
gmysql-dbname=pdns
gmysql-user=pdns
gmysql-password=
gmysql-dnssec=no
allow-axfr-ips=192.168.100.51
also-notify=192.168.100.51:54
primary=yes
secondary=no
resolver=127.0.0.1
expand-alias=yes
cache-ttl=6
negquery-cache-ttl=6
query-cache-ttl=6

Secondary (d2.xes-test.com)

allow-dnsupdate-from=0.0.0.0/0
dnsupdate=yes
include-dir=/etc/powerdns/pdns.d
launch=gmysql
local-port=54
log-dns-details=yes
log-dns-queries=yes
loglevel=9
default-soa-content=master.@ hostmaster.@ 0 1800 3600 604800 5400
gmysql-host=localhost
gmysql-dbname=pdns
gmysql-user=pdns
gmysql-password=
gmysql-dnssec=no
secondary=yes
autosecondary=yes
primary=no
xfr-cycle-interval=60
allow-axfr-ips=192.168.100.50
disable-axfr=no
allow-dnsupdate-from=192.168.100.50
allow-notify-from=192.168.100.50
expand-alias=yes

On the secondary server, d2.debug.com, I have an auto primary configured pointing to the IP of the primary server, with a NS of d2.debug.com.

 # pdnsutil list-autoprimaries
IP=192.168.100.50, NS=d2.debug.com, account=

When sending a notify on the primary, I get the following error on the secondary.

Nov 08 10:30:29 d2 pdns_server[111912]: Remote 192.168.100.50 wants 'debug.com|SOA', do = 0, bufsize = 512: packetcache MISS
Nov 08 10:30:29 d2 pdns_server[111912]: Received NOTIFY for debug.com from 192.168.100.50
Nov 08 10:30:29 d2 pdns_server[111912]: Received NOTIFY for debug.com from 192.168.100.50 for which we are not authoritative, trying supermaster
Nov 08 10:30:30 d2 pdns_server[111912]: While checking for supermaster, did not find NS for debug.com at: 192.168.100.50

Using dig, I've confirmed the nameservers exist and an A record exists as well.

 # dig @192.168.100.50 NS +short debug.com
d1.debug.com.
d2.debug.com.
 # dig @192.168.100.50 +short d2.debug.com
192.168.100.51

Perhaps I'm missing something obvious but I cannot get this to function, any ideas?

[johnwc]

We had this same issue as well. Our setup had dnsdist running and forwarding requests to dns recursor and auth server running on same server as documented as scenario 2 in the docs.

We noticed that the dig command would not pull back NS requests that contained the A records.

# dig @10.1.1.5 domain.net ns

; <<>> DiG 9.11.36-RedHat-9.11.36-11.el8_9.1 <<>> @10.1.1.5 domain.net ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30976
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;domain.net.                  IN      NS

;; ANSWER SECTION:
domain.net.           502     IN      NS      dns01.domain.net.
domain.net.           502     IN      NS      dns02.domain.net.

;; Query time: 0 msec
;; SERVER: 10.1.1.5#53(10.1.1.5)
;; WHEN: Tue May 28 02:03:14 EDT 2024
;; MSG SIZE  rcvd: 81

We had to update our dnsdist to have a rule that forced any queries coming from our secondary server to skip the recursor server. For some reason the recusror server would not reply back with the A records in the NS query response that the secondary pdns service was expecting.

Changed...
addAction(NetmaskGroupRule(recursive_ips), PoolAction('recursor'))
To...
addAction(AndRule({NetmaskGroupRule(recursive_ips), NotRule(makeRule("10.1.1.7/32"))}), PoolAction('recursor'))

Once the dnsdist update was in place, the NS query was now routing to the pdns service instead of recusor service, and everything worked.
Notice the A records now in the response.

# dig @10.1.1.5 domain.net ns

; <<>> DiG 9.11.36-RedHat-9.11.36-11.el8_9.1 <<>> @10.1.1.5 domain.net ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44155
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;domain.net.                  IN      NS

;; ANSWER SECTION:
domain.net.           3600    IN      NS      dns02.domain.net.
domain.net.           3600    IN      NS      dns01.domain.net.

;; ADDITIONAL SECTION:
dns01.domain.net.     3600    IN      A       10.1.1.5
dns02.domain.net.     3600    IN      A       10.1.1.7

;; Query time: 3 msec
;; SERVER: 10.1.1.5#53(10.1.1.5)
;; WHEN: Tue May 28 02:02:07 EDT 2024
;; MSG SIZE  rcvd: 113