# DNS Forwarding

> Configure DNS forwarding on VyOS: caching DNS resolver, upstream servers, split-horizon DNS, DNSSEC, and authoritative zones for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/services/vyos-dns/


VyOS uses PowerDNS Recursor to provide a DNS forwarding service - lightweight DNS infrastructure for small and medium-sized networks.

## Overview

DNS Forwarding allows you to:
- Cache DNS queries to speed up name resolution
- Forward queries to upstream DNS servers
- Provide split-horizon DNS (different answers for different domains)
- Act as a recursive DNS server
- Host authoritative DNS zones

## Basic Configuration

### Minimal Setup

```
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'
commit
```

This configuration:
- Listens on address 192.168.1.1
- Accepts queries from the 192.168.1.0/24 network
- Uses the system DNS servers as upstream

### Specifying Upstream DNS Servers

Explicitly specifying DNS servers:

```
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '8.8.4.4'
commit
```

### Using System DNS Servers

```
set service dns forwarding system
commit
```

This uses the DNS servers configured on the system (for example, obtained via DHCP on the WAN interface).

### Using DNS from a DHCP Client

```
set service dns forwarding dhcp eth0
commit
```

The DNS server will use the nameservers obtained via DHCP on the eth0 interface.

## Listen Address

The addresses on which the DNS server accepts queries:

Single address:
```
set service dns forwarding listen-address '192.168.1.1'
```

Multiple addresses:
```
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding listen-address '192.168.2.1'
set service dns forwarding listen-address '::1'
```

Listen on all interfaces (not recommended):
```
set service dns forwarding listen-address '0.0.0.0'
```

## Access Control

### Allow From

Allowing queries from specific networks:

```
set service dns forwarding allow-from '192.168.1.0/24'
set service dns forwarding allow-from '192.168.2.0/24'
set service dns forwarding allow-from '10.0.0.0/8'
```

By default, if not specified, only queries from localhost are allowed.

### Ignore Hosts File

Ignoring the local /etc/hosts file:

```
set service dns forwarding ignore-hosts-file
commit
```

## Domain-Specific Forwarding

Forwarding queries for specific domains to dedicated DNS servers.

### Basic Example

Sending queries for the example.com domain to a corporate DNS server:

```
set service dns forwarding domain example.com name-server '192.168.100.1'
commit
```

### Split-Horizon DNS

Different DNS servers for internal and external domains:

```
# Internal domains to the internal DNS
set service dns forwarding domain corp.local name-server '192.168.1.10'
set service dns forwarding domain internal.local name-server '192.168.1.10'

# External queries to public DNS
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '1.1.1.1'

commit
```

### Reverse DNS Zones

Forwarding reverse DNS zones:

```
set service dns forwarding domain 1.168.192.in-addr.arpa name-server '192.168.1.10'
set service dns forwarding domain 2.168.192.in-addr.arpa name-server '192.168.2.10'
commit
```

### Recursive Lookups in Subdomains

Adding the `addNTA` option to bypass DNSSEC:

```
set service dns forwarding domain example.com addnta
commit
```

## Caching

### Cache Size

DNS cache size (number of records):

```
set service dns forwarding cache-size 10000
commit
```

Default: 10000 records.

For high-load networks:
```
set service dns forwarding cache-size 50000
commit
```

### Negative TTL

The caching time for negative responses (NXDOMAIN):

```
set service dns forwarding negative-ttl 3600
commit
```

Value in seconds. Default: 3600 (1 hour).

## DNSSEC

DNS Security Extensions for verifying the authenticity of DNS responses.

### DNSSEC Modes

```
set service dns forwarding dnssec <mode>
```

Available modes:

- **off** - DNSSEC disabled (default)
- **process-no-validate** - process DNSSEC records but do not validate
- **process** - process and validate
- **log-fail** - log validation failures
- **validate** - strict validation (reject invalid responses)

Recommended setting:
```
set service dns forwarding dnssec validate
commit
```

## Authoritative Domains

Hosting your own DNS zones on VyOS.

### Creating a Zone

```
set service dns forwarding authoritative-domain example.local
commit
```

### Adding Records

#### A Record (IPv4)

```
set service dns forwarding authoritative-domain example.local records a server1 address '192.168.1.10'
set service dns forwarding authoritative-domain example.local records a server2 address '192.168.1.20'
commit
```

#### AAAA Record (IPv6)

```
set service dns forwarding authoritative-domain example.local records aaaa server1 address '2001:db8::10'
commit
```

#### CNAME Record (Alias)

```
set service dns forwarding authoritative-domain example.local records cname www target 'server1.example.local'
commit
```

#### MX Record (Mail)

```
set service dns forwarding authoritative-domain example.local records mx mail priority 10
set service dns forwarding authoritative-domain example.local records mx mail server 'mail.example.local'
commit
```

#### NS Record (Name Server)

```
set service dns forwarding authoritative-domain example.local records ns ns1 target 'dns1.example.local'
commit
```

#### PTR Record (Reverse DNS)

```
set service dns forwarding authoritative-domain 1.168.192.in-addr.arpa records ptr 10 target 'server1.example.local'
commit
```

#### TXT Record

```
set service dns forwarding authoritative-domain example.local records txt spf value 'v=spf1 mx ~all'
commit
```

#### SRV Record (Service)

```
set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0
set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0 hostname 'ldap.example.local'
set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0 port 389
set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0 priority 10
set service dns forwarding authoritative-domain example.local records srv _ldap._tcp entry 0 weight 100
commit
```

## Performance and Timeouts

### Timeout

Timeout for DNS queries (milliseconds):

```
set service dns forwarding timeout 1500
commit
```

Default: 1500ms.

### Max Cache Entries

Maximum number of cached records:

```
set service dns forwarding max-cache-entries 100000
commit
```

## Configuration Examples

### Home Network

```
# Basic setup
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'

# Public DNS servers
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '1.1.1.1'

# Cache
set service dns forwarding cache-size 10000

commit
```

### Corporate Network with Split-Horizon

```
# Listen on the management interface
set service dns forwarding listen-address '192.168.10.1'
set service dns forwarding allow-from '192.168.0.0/16'

# Internal domains to the corporate DNS
set service dns forwarding domain corp.local name-server '192.168.1.10'
set service dns forwarding domain corp.local name-server '192.168.1.11'

# Reverse zones
set service dns forwarding domain 10.168.192.in-addr.arpa name-server '192.168.1.10'
set service dns forwarding domain 20.168.192.in-addr.arpa name-server '192.168.1.10'

# External queries
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '8.8.4.4'

# Cache and DNSSEC
set service dns forwarding cache-size 50000
set service dns forwarding dnssec validate

commit
```

### Authoritative Zone for a Local Network

```
# DNS forwarding
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'
set service dns forwarding name-server '8.8.8.8'

# Local domain
set service dns forwarding authoritative-domain home.local

# Servers
set service dns forwarding authoritative-domain home.local records a router address '192.168.1.1'
set service dns forwarding authoritative-domain home.local records a nas address '192.168.1.10'
set service dns forwarding authoritative-domain home.local records a printer address '192.168.1.20'

# Aliases
set service dns forwarding authoritative-domain home.local records cname gateway target 'router.home.local'
set service dns forwarding authoritative-domain home.local records cname storage target 'nas.home.local'

commit
```

### Multi-Site with Several Locations

```
# DNS forwarding
set service dns forwarding listen-address '10.0.0.1'
set service dns forwarding allow-from '10.0.0.0/8'

# HQ site
set service dns forwarding domain hq.corp.local name-server '10.1.0.10'

# Branch office 1
set service dns forwarding domain branch1.corp.local name-server '10.10.0.10'

# Branch office 2
set service dns forwarding domain branch2.corp.local name-server '10.20.0.10'

# Shared corporate domain
set service dns forwarding domain corp.local name-server '10.1.0.10'
set service dns forwarding domain corp.local name-server '10.1.0.11'

# Internet
set service dns forwarding name-server '8.8.8.8'
set service dns forwarding name-server '1.1.1.1'

# Performance
set service dns forwarding cache-size 100000
set service dns forwarding dnssec validate

commit
```

### DNSSEC with Validation

```
set service dns forwarding listen-address '192.168.1.1'
set service dns forwarding allow-from '192.168.1.0/24'

# DNS servers with DNSSEC support
set service dns forwarding name-server '1.1.1.1'
set service dns forwarding name-server '9.9.9.9'

# Enable DNSSEC validation
set service dns forwarding dnssec validate

# Increase the cache for DNSSEC
set service dns forwarding cache-size 20000

commit
```

## Operational Commands

### Clearing the Cache

Full cache flush:
```
reset dns forwarding all
```

Flush for a specific domain:
```
reset dns forwarding domain example.com
```

### Restarting the Service

```
restart dns forwarding
```

### Viewing Statistics

Show DNS statistics:
```
show dns forwarding statistics
```

### Testing

Verifying name resolution through VyOS DNS:
```
nslookup example.com 192.168.1.1
```

or

```
dig @192.168.1.1 example.com
```

### Logs

Viewing DNS logs:
```
show log dns forwarding
monitor log | grep recursor
```

## Integration with DHCP

The DHCP server can automatically use DNS forwarding.

In the DHCP configuration, specify:
```
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option name-server '192.168.1.1'
```

Where 192.168.1.1 is the address of the VyOS host running DNS forwarding.

## Troubleshooting

### DNS Not Responding

Check the configuration:
```
show service dns forwarding
```

Check whether the service is running:
```
show dns forwarding statistics
```

Check the firewall:
```
show firewall ipv4 input filter
```

Make sure UDP port 53 is open:
```
set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 destination port 53
set firewall ipv4 input filter rule 30 protocol udp
set firewall ipv4 input filter rule 30 source address 192.168.1.0/24
commit
```

### Slow Name Resolution

Increase the cache size:
```
set service dns forwarding cache-size 50000
commit
```

Check the upstream DNS servers:
```
dig @8.8.8.8 example.com
```

Switch the upstream to faster servers:
```
set service dns forwarding name-server '1.1.1.1'
set service dns forwarding name-server '8.8.8.8'
commit
```

### DNSSEC Issues

If validation causes problems, disable it:
```
set service dns forwarding dnssec off
commit
```

Or use a less strict mode:
```
set service dns forwarding dnssec process
commit
```

### Split-Horizon Not Working

Make sure the domain-specific rules are specified correctly:
```
show service dns forwarding
```

Order matters - more specific domains must be specified first.

Verify by testing:
```
dig @192.168.1.1 server.corp.local
```

## Security

### Restricting Access

Always use `allow-from` to restrict the sources:
```
set service dns forwarding allow-from '192.168.1.0/24'
```

Never use `0.0.0.0/0` in allow-from - this would open DNS to the entire internet (DNS amplification attacks).

### Firewall Rules

Additionally restrict access through the firewall:
```
set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 destination port 53
set firewall ipv4 input filter rule 30 protocol udp
set firewall ipv4 input filter rule 30 source address 192.168.1.0/24
commit
```

### Rate Limiting

Use firewall rate limiting to protect against DoS:
```
set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 destination port 53
set firewall ipv4 input filter rule 30 protocol udp
set firewall ipv4 input filter rule 30 limit rate 50/second
commit
```

### DNSSEC

Enable DNSSEC to protect against DNS spoofing:
```
set service dns forwarding dnssec validate
commit
```

## Best Practices

1. **Use allow-from** - always restrict the sources of queries
2. **Multiple upstreams** - specify 2-3 upstream DNS servers
3. **DNSSEC** - enable it for security
4. **Cache** - tune the cache size to match the load
5. **Split-horizon** - separate internal and external domains
6. **Firewall** - add extra protection through the firewall
7. **Monitoring** - regularly review statistics and logs
8. **Redundancy** - use multiple DNS servers
9. **Documentation** - document domain-specific forwarding
10. **Testing** - verify name resolution after changes

## Public DNS Servers

Recommended public DNS servers:

- **Cloudflare**: 1.1.1.1, 1.0.0.1 (fast, private)
- **Google**: 8.8.8.8, 8.8.4.4 (reliable)
- **Quad9**: 9.9.9.9, 149.112.112.112 (malicious domain blocking)
- **OpenDNS**: 208.67.222.222, 208.67.220.220 (content filtering)

## Next Steps

- [DHCP Server](/docs/vyos/services/vyos-dhcp/) - DHCP integration with DNS
- [Dynamic DNS](/docs/vyos/services/vyos-ddns/) - automatic DNS updates
- [Firewall](/docs/vyos/firewall/) - protecting the DNS service