syntax: --aggressive-cache-max-nsec3-hash-cost=... Maximum estimated NSEC3 cost for a given query to consider aggressive use of the NSEC3 cache --aggressive-cache-min-nsec3-hit-ratio=... The minimum expected hit ratio to store NSEC3 records into the aggressive cache --aggressive-nsec-cache-size=... The number of records to cache in the aggressive cache. If set to a value greater than 0, and DNSSEC processing or validation is enabled, the recursor will cache NSEC and NSEC3 records to generate negative answers, as defined in rfc8198 --allow-from=... If set, only allow these comma separated netmasks to recurse --allow-from-file=... If set, load allowed netmasks from this file --allow-no-rd | --allow-no-rd=yes | --allow-no-rd=no Allow 'no recursion desired (RD=0)' queries. --allow-notify-for=... If set, NOTIFY requests for these zones will be allowed --allow-notify-for-file=... If set, load NOTIFY-allowed zones from this file --allow-notify-from=... If set, NOTIFY requests from these comma separated netmasks will be allowed --allow-notify-from-file=... If set, load NOTIFY-allowed netmasks from this file --allow-trust-anchor-query | --allow-trust-anchor-query=yes | --allow-trust-anchor-query=no Allow queries for trustanchor.server CH TXT and negativetrustanchor.server CH TXT --allowed-additional-qtypes=... Sequence of AllowedAdditionalQType --any-to-tcp | --any-to-tcp=yes | --any-to-tcp=no Answer ANY queries with tc=1, shunting to TCP --api-config-dir=... Directory where REST API stores config and zones --api-key=... Static pre-shared authentication key for access to the REST API --auth-zones=... Zones for which we have authoritative data, comma separated domain=file pairs --bypass-server-throttling-probability=... Determines the probability of a server marked down to be used anyway --carbon-instance=... If set overwrites the instance name default --carbon-interval=... Number of seconds between carbon (graphite) updates --carbon-namespace=... If set overwrites the first part of the carbon string --carbon-ourname=... If set, overrides our reported hostname for carbon stats --carbon-server=... If set, send metrics in carbon (graphite) format to this server IP address --chroot=... switch to chroot jail --client-tcp-timeout=... Timeout in seconds when talking to TCP clients --config Output blank configuration. You can use --config=check to test the config file and command line arguments. --config-dir=... Location of configuration directory (recursor.conf or recursor.yml) --config-name=... Name of this virtual configuration - will rename the binary image --cpu-map=... Thread to CPU mapping, space separated thread-id=cpu1,cpu2..cpuN pairs --daemon | --daemon=yes | --daemon=no Operate as a daemon --devonly-regression-test-mode | --devonly-regression-test-mode=yes | --devonly-regression-test-mode=no internal use only --disable-packetcache | --disable-packetcache=yes | --disable-packetcache=no Disable packetcache --disable-syslog | --disable-syslog=yes | --disable-syslog=no Disable logging to syslog, useful when running inside a supervisor that logs stderr --distribution-load-factor=... The load factor used when PowerDNS is distributing queries to worker threads --distribution-pipe-buffer-size=... Size in bytes of the internal buffer of the pipe used by the distributor to pass incoming queries to a worker thread --distributor-threads=... Launch this number of distributor threads, distributing queries to other threads --dns64-prefix=... DNS64 prefix --dnssec=... DNSSEC mode: off/process-no-validate/process (default)/log-fail/validate --dnssec-disabled-algorithms=... List of DNSSEC algorithm numbers that are considered unsupported --dnssec-log-bogus | --dnssec-log-bogus=yes | --dnssec-log-bogus=no Log DNSSEC bogus validations --dnstap-framestream-servers=... Sequence of dnstap servers --dnstap-nod-framestream-servers=... Sequence of NOD dnstap servers --dont-query=... If set, do not query these netmasks for DNS data --dont-throttle-names=... Do not throttle nameservers with this name or suffix --dont-throttle-netmasks=... Do not throttle nameservers with this IP netmask --dot-to-auth-names=... Use DoT to authoritative servers with these names or suffixes --dot-to-port-853 | --dot-to-port-853=yes | --dot-to-port-853=no Force DoT connection to target port 853 if DoT compiled in --ecs-add-for=... List of client netmasks for which EDNS Client Subnet will be added --ecs-cache-limit-ttl=... Minimum TTL to cache ECS response --ecs-ipv4-bits=... Number of bits of IPv4 address to pass for EDNS Client Subnet --ecs-ipv4-cache-bits=... Maximum number of bits of IPv4 mask to cache ECS response --ecs-ipv4-never-cache | --ecs-ipv4-never-cache=yes | --ecs-ipv4-never-cache=no If we should never cache IPv4 ECS responses --ecs-ipv6-bits=... Number of bits of IPv6 address to pass for EDNS Client Subnet --ecs-ipv6-cache-bits=... Maximum number of bits of IPv6 mask to cache ECS response --ecs-ipv6-never-cache | --ecs-ipv6-never-cache=yes | --ecs-ipv6-never-cache=no If we should never cache IPv6 ECS responses --ecs-minimum-ttl-override=... The minimum TTL for records in ECS-specific answers --ecs-scope-zero-address=... Address to send to allow-listed authoritative servers for incoming queries with ECS prefix-length source of 0 --edns-outgoing-bufsize=... Outgoing EDNS buffer size --edns-padding-from=... List of netmasks (proxy IP in case of proxy-protocol presence, client IP otherwise) for which EDNS padding will be enabled in responses, provided that 'edns-padding-mode' applies --edns-padding-mode=... Whether to add EDNS padding to all responses ('always') or only to responses for queries containing the EDNS padding option ('padded-queries-only', the default). In both modes, padding will only be added to responses for queries coming from 'setting-edns-padding-from' sources --edns-padding-out | --edns-padding-out=yes | --edns-padding-out=no Whether to add EDNS padding to outgoing DoT messages --edns-padding-tag=... Packetcache tag associated to responses sent with EDNS padding, to prevent sending these to clients for which padding is not enabled. --edns-subnet-allow-list=... List of netmasks and domains that we should enable EDNS subnet for --edns-subnet-harden | --edns-subnet-harden=yes | --edns-subnet-harden=no Do more strict checking or EDNS Client Subnet information returned by authoritative servers --edns-subnet-whitelist=... List of netmasks and domains that we should enable EDNS subnet for (deprecated) --enable-old-settings | --enable-old-settings=yes | --enable-old-settings=no Enable (deprecated) parsing of old-style settings --entropy-source=... If set, read entropy from this file --etc-hosts-file=... Path to 'hosts' file --event-trace-enabled=... If set, event traces are collected and send out via protobuf logging (1), logfile (2), opentelemetry trace data (4) or a combination --export-etc-hosts | --export-etc-hosts=yes | --export-etc-hosts=no If we should serve up contents from /etc/hosts --export-etc-hosts-search-suffix=... Also serve up the contents of /etc/hosts with this suffix --extended-resolution-errors | --extended-resolution-errors=yes | --extended-resolution-errors=no If set, send an EDNS Extended Error extension on resolution failures, like DNSSEC validation errors --forward-zones=... Zones for which we forward queries, comma separated domain=ip pairs --forward-zones-file=... File with (+)domain=ip pairs for forwarding --forward-zones-recurse=... Zones for which we forward queries with recursion bit, comma separated domain=ip pairs --forwarding-catalog-zones=... Sequence of ForwardingCatalogZone --gettag-needs-edns-options | --gettag-needs-edns-options=yes | --gettag-needs-edns-options=no If EDNS Options should be extracted before calling the gettag() hook --help Provide a helpful message --hint-file=... If set, load root hints from this file --ignore-unknown-settings=... Configuration settings to ignore if they are unknown --include-dir=... Include settings files from this directory. --latency-statistic-size=... Number of latency values to calculate the qa-latency average --limit-qtype-any | --limit-qtype-any=yes | --limit-qtype-any=no Limit answers to ANY queries in size --listen=... IP addresses and associated attributes for the webserver to listen on --local-address=... IP addresses to listen on, separated by spaces or commas. Also accepts ports. --local-port=... port to listen on --log-common-errors | --log-common-errors=yes | --log-common-errors=no If we should log rather common errors --log-rpz-changes | --log-rpz-changes=yes | --log-rpz-changes=no Log additions and removals to RPZ zones at Info level --log-timestamp | --log-timestamp=yes | --log-timestamp=no Print timestamps in log lines, useful to disable when running with a tool that timestamps stderr already --logging-facility=... Facility to log messages as. 0 corresponds to local0 --loglevel=... Amount of logging. Higher is more. Do not set below 3 --lowercase-outgoing | --lowercase-outgoing=yes | --lowercase-outgoing=no Force outgoing questions to lowercase --lua-config-file=... More powerful configuration options --lua-dns-script=... Filename containing an optional Lua script that will be used to modify dns answers --lua-global-include-dir=... More powerful configuration options --lua-maintenance-interval=... Number of seconds between calls to the lua user defined maintenance() function --lua-start-stop-script=... Lua script containing functions to run on startup and shutdown --max-busy-dot-probes=... Maximum number of concurrent DoT probes --max-bytesperq=... Maximum number of received bytes per client query --max-cache-bogus-ttl=... maximum number of seconds to keep a Bogus (positive or negative) cached entry in memory --max-cache-entries=... If set, maximum number of entries in the main cache --max-cache-ttl=... maximum number of seconds to keep a cached entry in memory --max-chain-length=... maximum number of queries that can be chained to an outgoing request, 0 is no limit --max-cnames-followed=... Maximum number CNAME records followed --max-concurrent-requests-per-tcp-connection=... Maximum number of requests handled concurrently per TCP connection --max-dnskeys=... Maximum number of DNSKEYs with the same algorithm and tag to consider when validating a given record --max-ds-per-zone=... Maximum number of DS records to consider per zone --max-generate-steps=... Maximum number of $GENERATE steps when loading a zone from a file --max-include-depth=... Maximum nested $INCLUDE depth when loading a zone from a file --max-mthreads=... Maximum number of simultaneous Mtasker threads --max-negative-ttl=... maximum number of seconds to keep a negative cached entry in memory --max-ns-address-qperq=... Maximum outgoing NS address queries per query --max-ns-per-resolve=... Maximum number of NS records to consider to resolve a name, 0 is no limit --max-nsec3-hash-computations-per-query=... Maximum number of NSEC3 hashes that we are willing to compute during DNSSEC validation, per incoming query --max-nsec3s-per-record=... Maximum number of NSEC3s to consider when validating a given denial of existence --max-packetcache-entries=... maximum number of entries to keep in the packetcache --max-packetcache-entry-size=... maximum size of a packet stored in the the packet cache --max-pointers-per-name=... Maximum number of name pointers followed per name. --max-pointers-per-packet-byte=... Maximum number of name pointers per DNS packet byte followed. --max-pointers-to-pointers=... Maximum number of name pointers pointing directly to another pointer per name. --max-qperq=... Maximum outgoing queries per client query --max-recordcache-entry-size=... maximum storage size of a recordset stored in record cache --max-recursion-depth=... Maximum number of internal recursion calls per query, 0 for unlimited --max-rrset-size=... Maximum size of RRSet in cache --max-rrsigs-per-record=... Maximum number of RRSIGs to consider when validating a given record --max-signature-validations-per-query=... Maximum number of RRSIG signatures we are willing to validate per incoming query --max-tcp-clients=... Maximum number of simultaneous TCP clients --max-tcp-per-client=... If set, maximum number of TCP sessions per client (IP address) --max-tcp-queries-per-connection=... If set, maximum number of TCP queries in a TCP connection --max-total-msec=... Maximum total wall-clock time per query in milliseconds, 0 for unlimited --max-udp-queries-per-round=... Maximum number of UDP queries processed per recvmsg() round, before returning back to normal processing --minimum-ttl-override=... The minimum TTL --negative-trustanchors=... A sequence of negative trust anchors --network-timeout=... Wait this number of milliseconds for network i/o --new-domain-db-size=... Size of the DB used to track new domains in terms of number of cells. Defaults to 67108864 --new-domain-db-snapshot-interval=... Interval (in seconds) to write the NOD and UDR DB snapshots --new-domain-history-dir=... Persist new domain tracking data here to persist between restarts --new-domain-ignore-list=... List of domains (and implicitly all subdomains) which will never be considered a new domain --new-domain-ignore-list-file=... File with a list of domains (and implicitly all subdomains) which will never be considered a new domain --new-domain-log | --new-domain-log=yes | --new-domain-log=no Log newly observed domains. --new-domain-lookup=... Perform a DNS lookup newly observed domains as a subdomain of the configured domain --new-domain-pb-tag=... If protobuf is configured, the tag to use for messages containing newly observed domains. Defaults to 'pdns-nod' --new-domain-tracking | --new-domain-tracking=yes | --new-domain-tracking=no Track newly observed domains (i.e. never seen before). --new-domain-whitelist=... List of domains (and implicitly all subdomains) which will never be considered a new domain (deprecated) --no-shuffle | --no-shuffle=yes | --no-shuffle=no Don't change --non-local-bind | --non-local-bind=yes | --non-local-bind=no Enable binding to non-local addresses by using FREEBIND / BINDANY socket options --non-resolving-ns-max-fails=... Number of failed address resolves of a nameserver to start throttling it, 0 is disabled --non-resolving-ns-throttle-time=... Number of seconds to throttle a nameserver with a name failing to resolve --nothing-below-nxdomain=... When an NXDOMAIN exists in cache for a name with fewer labels than the qname, send NXDOMAIN without doing a lookup (see RFC 8020) --nsec3-max-iterations=... Maximum number of iterations allowed for an NSEC3 record --outgoing-protobuf-servers=... List of outgoing protobuf servers --packetcache-negative-ttl=... maximum number of seconds to keep a cached NxDomain or NoData entry in packetcache --packetcache-servfail-ttl=... maximum number of seconds to keep a cached servfail entry in packetcache --packetcache-shards=... Number of shards in the packet cache --packetcache-ttl=... maximum number of seconds to keep a cached entry in packetcache --pdns-distributes-queries | --pdns-distributes-queries=yes | --pdns-distributes-queries=no If PowerDNS itself should distribute queries over threads --processes=... Launch this number of processes (EXPERIMENTAL, DO NOT CHANGE) --protobuf-mask-v4=... Network mask to apply for client IPv4 addresses in protobuf messages --protobuf-mask-v6=... Network mask to apply for client IPv6 addresses in protobuf messages --protobuf-servers=... Sequence of protobuf servers --protobuf-use-kernel-timestamp | --protobuf-use-kernel-timestamp=yes | --protobuf-use-kernel-timestamp=no Compute the latency of queries in protobuf messages by using the timestamp set by the kernel when the query was received (when available) --proxy-protocol-exceptions=... A Proxy Protocol header should not be used for these listen addresses. --proxy-protocol-from=... A Proxy Protocol header is required from these subnets --proxy-protocol-maximum-size=... The maximum size of a proxy protocol payload, including the TLV values --proxymappings=... Sequence of ProxyMapping --public-suffix-list-file=... Path to the Public Suffix List file, if any --qname-max-minimize-count=... RFC9156 max minimize count --qname-minimization | --qname-minimization=yes | --qname-minimization=no Use Query Name Minimization --qname-minimize-one-label=... RFC9156 minimize one label parameter --query-local-address=... Source IP address for sending queries --quiet | --quiet=yes | --quiet=no Suppress logging of questions and answers --record-cache-locked-ttl-perc=... Replace records in record cache only after this % of original TTL has passed --record-cache-shards=... Number of shards in the record cache --refresh-on-ttl-perc=... If a record is requested from the cache and only this % of original TTL remains, refetch --reuseport | --reuseport=yes | --reuseport=no Enable SO_REUSEPORT allowing multiple recursors processes to listen to 1 address --rng=... Specify random number generator to use. Valid values are auto,sodium,openssl,getrandom,arc4random,urandom. --root-nx-trust | --root-nx-trust=yes | --root-nx-trust=no If set, believe that an NXDOMAIN from the root means the TLD does not exist --rpzs=... Sequence of RPZ entries --save-parent-ns-set | --save-parent-ns-set=yes | --save-parent-ns-set=no Save parent NS set to be used if child NS set fails --security-poll-suffix=... Domain name from which to query security update notifications --serve-rfc1918 | --serve-rfc1918=yes | --serve-rfc1918=no If we should be authoritative for RFC 1918 private IP space --serve-rfc6303 | --serve-rfc6303=yes | --serve-rfc6303=no If we should be authoritative for RFC 6303 private IP space --serve-stale-extensions=... Number of times a record's ttl is extended by 30s to be served stale --server-down-max-fails=... Maximum number of consecutive timeouts (and unreachables) to mark a server as down ( 0 => disabled ) --server-down-throttle-time=... Number of seconds to throttle all queries to a server after being marked as down --server-id=... Returned when queried for 'id.server' TXT or NSID, defaults to hostname, set custom or 'disabled' --setgid=... If set, change group id to this gid for more security --setuid=... If set, change user id to this uid for more security --signature-inception-skew=... Allow the signature inception to be off by this number of seconds --single-socket | --single-socket=yes | --single-socket=no If set, only use a single socket for outgoing queries --snmp-agent | --snmp-agent=yes | --snmp-agent=no If set, register as an SNMP agent --snmp-daemon-socket=... If set and snmp-agent is set, the socket to use to register to the SNMP daemon --snmp-master-socket=... If set and snmp-agent is set, the socket to use to register to the SNMP daemon (deprecated) --soa-minimum-ttl=... Don't change --socket-dir=... Where the controlsocket will live, /var/run/pdns-recursor when unset and not chrooted --socket-group=... Group of socket --socket-mode=... Permissions for socket --socket-owner=... Owner of socket --sortlists=... Sequence of sort lists --spoof-nearmiss-max=... If non-zero, assume spoofing after this many near misses --stack-cache-size=... Size of the stack cache, per mthread --stack-size=... stack size per mthread --statistics-interval=... Number of seconds between printing of recursor statistics, 0 to disable --stats-api-blacklist=... List of statistics that are disabled when retrieving the complete list of statistics via the API (deprecated) --stats-api-disabled-list=... List of statistics that are disabled when retrieving the complete list of statistics via the API --stats-carbon-blacklist=... List of statistics that are prevented from being exported via Carbon (deprecated) --stats-carbon-disabled-list=... List of statistics that are prevented from being exported via Carbon --stats-rec-control-blacklist=... List of statistics that are prevented from being exported via rec_control get-all (deprecated) --stats-rec-control-disabled-list=... List of statistics that are prevented from being exported via rec_control get-all --stats-ringbuffer-entries=... maximum number of packets to store statistics for --stats-snmp-blacklist=... List of statistics that are prevented from being exported via SNMP (deprecated) --stats-snmp-disabled-list=... List of statistics that are prevented from being exported via SNMP --structured-logging | --structured-logging=yes | --structured-logging=no Prefer structured logging --structured-logging-backend=... Structured logging backend --system-resolver-interval=... Set interval (in seconds) of the re-resolve checks of system resolver subsystem. --system-resolver-self-resolve-check | --system-resolver-self-resolve-check=yes | --system-resolver-self-resolve-check=no Check for potential self-resolve, default enabled. --system-resolver-ttl=... Set TTL of system resolver feature, 0 (default) is disabled --tcp-fast-open=... Enable TCP Fast Open support on the listening sockets, using the supplied numerical value as the queue size --tcp-fast-open-connect | --tcp-fast-open-connect=yes | --tcp-fast-open-connect=no Enable TCP Fast Open support on outgoing sockets --tcp-out-max-idle-ms=... Time TCP/DoT connections are left idle in milliseconds or 0 if no limit --tcp-out-max-idle-per-auth=... Maximum number of idle TCP/DoT connections to a specific IP per thread, 0 means do not keep idle connections open --tcp-out-max-idle-per-thread=... Maximum number of idle TCP/DoT connections per thread --tcp-out-max-queries=... Maximum total number of queries per TCP/DoT connection, 0 means no limit --tcp-threads=... Launch this number of threads listening for and processing TCP queries --threads=... Launch this number of threads --trace=... if we should output heaps of logging. set to 'fail' to only log failing domains --trustanchorfile=... A path to a zone file containing trust anchors --trustanchorfile-interval=... Interval (in hours) to read the trust anchors file --trustanchors=... Sequence of trust anchors --udp-source-port-avoid=... List of comma separated UDP port numbers to avoid --udp-source-port-max=... Maximum UDP port to bind on --udp-source-port-min=... Minimum UDP port to bind on --udp-truncation-threshold=... Maximum UDP response size before we truncate --unique-response-db-size=... Size of the DB used to track unique responses in terms of number of cells. Defaults to 67108864 --unique-response-history-dir=... Persist unique response tracking data here to persist between restarts --unique-response-ignore-list=... List of domains (and implicitly all subdomains) which will never be considered for UDR --unique-response-ignore-list-file=... File with list of domains (and implicitly all subdomains) which will never be considered for UDR --unique-response-log | --unique-response-log=yes | --unique-response-log=no Log unique responses --unique-response-pb-tag=... If protobuf is configured, the tag to use for messages containing unique DNS responses. Defaults to 'pdns-udr' --unique-response-tracking | --unique-response-tracking=yes | --unique-response-tracking=no Track unique responses (tuple of query name, type and RR). --use-incoming-edns-subnet | --use-incoming-edns-subnet=yes | --use-incoming-edns-subnet=no Pass along received EDNS Client Subnet information --version Print version string --version-string=... string reported on version.pdns or version.bind --webserver | --webserver=yes | --webserver=no Start a webserver (for REST API) --webserver-address=... IP Address of webserver to listen on --webserver-allow-from=... Webserver access is only allowed from these subnets --webserver-hash-plaintext-credentials | --webserver-hash-plaintext-credentials=yes | --webserver-hash-plaintext-credentials=no Whether to hash passwords and api keys supplied in plaintext, to prevent keeping the plaintext version in memory at runtime --webserver-loglevel=... Amount of logging in the webserver (none, normal, detailed) --webserver-max-request-size=... Maximum size for webserver requests in megabytes --webserver-password=... Password required for accessing the webserver --webserver-port=... Port of webserver to listen on --write-pid | --write-pid=yes | --write-pid=no Write a PID file --x-dnssec-names=... Collect DNSSEC statistics for names or suffixes in this list in separate x-dnssec counters --zonetocaches=... Sequence of ZoneToCache entries