/usr/bin/pdns_recursor

syntax:

  --aggressive-cache-max-nsec3-hash-cost=...
	Maximum estimated NSEC3 cost for a given query to consider aggressive use of the NSEC3 cache
  --aggressive-cache-min-nsec3-hit-ratio=...
	The minimum expected hit ratio to store NSEC3 records into the aggressive cache
  --aggressive-nsec-cache-size=...
	The number of records to cache in the aggressive cache. If set to a value greater than 0, and DNSSEC processing or validation is enabled, the recursor will cache NSEC and NSEC3 records to generate negative answers, as defined in rfc8198
  --allow-from=...
	If set, only allow these comma separated netmasks to recurse
  --allow-from-file=...
	If set, load allowed netmasks from this file
  --allow-no-rd | --allow-no-rd=yes | --allow-no-rd=no
	Allow 'no recursion desired (RD=0)' queries.
  --allow-notify-for=...
	If set, NOTIFY requests for these zones will be allowed
  --allow-notify-for-file=...
	If set, load NOTIFY-allowed zones from this file
  --allow-notify-from=...
	If set, NOTIFY requests from these comma separated netmasks will be allowed
  --allow-notify-from-file=...
	If set, load NOTIFY-allowed netmasks from this file
  --allow-trust-anchor-query | --allow-trust-anchor-query=yes | --allow-trust-anchor-query=no
	Allow queries for trustanchor.server CH TXT and negativetrustanchor.server CH TXT
  --allowed-additional-qtypes=...
	Sequence of AllowedAdditionalQType
  --any-to-tcp | --any-to-tcp=yes | --any-to-tcp=no
	Answer ANY queries with tc=1, shunting to TCP
  --api-config-dir=...
	Directory where REST API stores config and zones
  --api-key=...
	Static pre-shared authentication key for access to the REST API
  --auth-zones=...
	Zones for which we have authoritative data, comma separated domain=file pairs
  --bypass-server-throttling-probability=...
	Determines the probability of a server marked down to be used anyway
  --carbon-instance=...
	If set overwrites the instance name default
  --carbon-interval=...
	Number of seconds between carbon (graphite) updates
  --carbon-namespace=...
	If set overwrites the first part of the carbon string
  --carbon-ourname=...
	If set, overrides our reported hostname for carbon stats
  --carbon-server=...
	If set, send metrics in carbon (graphite) format to this server IP address
  --chroot=...
	switch to chroot jail
  --client-tcp-timeout=...
	Timeout in seconds when talking to TCP clients
  --config
	Output blank configuration. You can use --config=check to test the config file and command line arguments.
  --config-dir=...
	Location of configuration directory (recursor.conf or recursor.yml)
  --config-name=...
	Name of this virtual configuration - will rename the binary image
  --cpu-map=...
	Thread to CPU mapping, space separated thread-id=cpu1,cpu2..cpuN pairs
  --daemon | --daemon=yes | --daemon=no
	Operate as a daemon
  --devonly-regression-test-mode | --devonly-regression-test-mode=yes | --devonly-regression-test-mode=no
	internal use only
  --disable-packetcache | --disable-packetcache=yes | --disable-packetcache=no
	Disable packetcache
  --disable-syslog | --disable-syslog=yes | --disable-syslog=no
	Disable logging to syslog, useful when running inside a supervisor that logs stderr
  --distribution-load-factor=...
	The load factor used when PowerDNS is distributing queries to worker threads
  --distribution-pipe-buffer-size=...
	Size in bytes of the internal buffer of the pipe used by the distributor to pass incoming queries to a worker thread
  --distributor-threads=...
	Launch this number of distributor threads, distributing queries to other threads
  --dns64-prefix=...
	DNS64 prefix
  --dnssec=...
	DNSSEC mode: off/process-no-validate/process (default)/log-fail/validate
  --dnssec-disabled-algorithms=...
	List of DNSSEC algorithm numbers that are considered unsupported
  --dnssec-log-bogus | --dnssec-log-bogus=yes | --dnssec-log-bogus=no
	Log DNSSEC bogus validations
  --dnstap-framestream-servers=...
	Sequence of dnstap servers
  --dnstap-nod-framestream-servers=...
	Sequence of NOD dnstap servers
  --dont-query=...
	If set, do not query these netmasks for DNS data
  --dont-throttle-names=...
	Do not throttle nameservers with this name or suffix
  --dont-throttle-netmasks=...
	Do not throttle nameservers with this IP netmask
  --dot-to-auth-names=...
	Use DoT to authoritative servers with these names or suffixes
  --dot-to-port-853 | --dot-to-port-853=yes | --dot-to-port-853=no
	Force DoT connection to target port 853 if DoT compiled in
  --ecs-add-for=...
	List of client netmasks for which EDNS Client Subnet will be added
  --ecs-cache-limit-ttl=...
	Minimum TTL to cache ECS response
  --ecs-ipv4-bits=...
	Number of bits of IPv4 address to pass for EDNS Client Subnet
  --ecs-ipv4-cache-bits=...
	Maximum number of bits of IPv4 mask to cache ECS response
  --ecs-ipv4-never-cache | --ecs-ipv4-never-cache=yes | --ecs-ipv4-never-cache=no
	If we should never cache IPv4 ECS responses
  --ecs-ipv6-bits=...
	Number of bits of IPv6 address to pass for EDNS Client Subnet
  --ecs-ipv6-cache-bits=...
	Maximum number of bits of IPv6 mask to cache ECS response
  --ecs-ipv6-never-cache | --ecs-ipv6-never-cache=yes | --ecs-ipv6-never-cache=no
	If we should never cache IPv6 ECS responses
  --ecs-minimum-ttl-override=...
	The minimum TTL for records in ECS-specific answers
  --ecs-scope-zero-address=...
	Address to send to allow-listed authoritative servers for incoming queries with ECS prefix-length source of 0
  --edns-outgoing-bufsize=...
	Outgoing EDNS buffer size
  --edns-padding-from=...
	List of netmasks (proxy IP in case of proxy-protocol presence, client IP otherwise) for which EDNS padding will be enabled in responses, provided that 'edns-padding-mode' applies
  --edns-padding-mode=...
	Whether to add EDNS padding to all responses ('always') or only to responses for queries containing the EDNS padding option ('padded-queries-only', the default). In both modes, padding will only be added to responses for queries coming from 'setting-edns-padding-from' sources
  --edns-padding-out | --edns-padding-out=yes | --edns-padding-out=no
	Whether to add EDNS padding to outgoing DoT messages
  --edns-padding-tag=...
	Packetcache tag associated to responses sent with EDNS padding, to prevent sending these to clients for which padding is not enabled.
  --edns-subnet-allow-list=...
	List of netmasks and domains that we should enable EDNS subnet for
  --edns-subnet-harden | --edns-subnet-harden=yes | --edns-subnet-harden=no
	Do more strict checking or EDNS Client Subnet information returned by authoritative servers
  --enable-old-settings | --enable-old-settings=yes | --enable-old-settings=no
	Enable (deprecated) parsing of old-style settings
  --entropy-source=...

  --etc-hosts-file=...
	Path to 'hosts' file
  --event-trace-enabled=...
	If set, event traces are collected and send out via protobuf logging (1), logfile (2), opentelemetry trace data (4) or a combination
  --export-etc-hosts | --export-etc-hosts=yes | --export-etc-hosts=no
	If we should serve up contents from /etc/hosts
  --export-etc-hosts-search-suffix=...
	Also serve up the contents of /etc/hosts with this suffix
  --extended-resolution-errors | --extended-resolution-errors=yes | --extended-resolution-errors=no
	If set, send an EDNS Extended Error extension on resolution failures, like DNSSEC validation errors
  --forward-zones=...
	Zones for which we forward queries, comma separated domain=ip pairs
  --forward-zones-file=...
	File with (+)domain=ip pairs for forwarding
  --forward-zones-recurse=...
	Zones for which we forward queries with recursion bit, comma separated domain=ip pairs
  --forwarding-catalog-zones=...
	Sequence of ForwardingCatalogZone
  --gettag-needs-edns-options | --gettag-needs-edns-options=yes | --gettag-needs-edns-options=no
	If EDNS Options should be extracted before calling the gettag() hook
  --help
	Provide a helpful message
  --hint-file=...
	If set, load root hints from this file
  --ignore-unknown-settings=...
	Configuration settings to ignore if they are unknown
  --include-dir=...
	Include settings files from this directory.
  --latency-statistic-size=...
	Number of latency values to calculate the qa-latency average
  --limit-qtype-any | --limit-qtype-any=yes | --limit-qtype-any=no
	Limit answers to ANY queries in size
  --listen=...
	IP addresses and associated attributes for the webserver to listen on
  --local-address=...
	IP addresses to listen on, separated by spaces or commas. Also accepts ports.
  --local-port=...
	port to listen on
  --log-common-errors | --log-common-errors=yes | --log-common-errors=no
	If we should log rather common errors
  --log-rpz-changes | --log-rpz-changes=yes | --log-rpz-changes=no
	Log additions and removals to RPZ zones at Info level
  --log-timestamp | --log-timestamp=yes | --log-timestamp=no
	Print timestamps in log lines, useful to disable when running with a tool that timestamps stderr already
  --logging-facility=...
	Facility to log messages as. 0 corresponds to local0
  --loglevel=...
	Amount of logging. Higher is more. Do not set below 3
  --lowercase-outgoing | --lowercase-outgoing=yes | --lowercase-outgoing=no
	Force outgoing questions to lowercase
  --lua-config-file=...
	More powerful configuration options
  --lua-dns-script=...
	Filename containing an optional Lua script that will be used to modify dns answers
  --lua-global-include-dir=...
	More powerful configuration options
  --lua-maintenance-interval=...
	Number of seconds between calls to the lua user defined maintenance() function
  --lua-start-stop-script=...
	Lua script containing functions to run on startup and shutdown
  --max-busy-dot-probes=...
	Maximum number of concurrent DoT probes
  --max-bytesperq=...
	Maximum number of received bytes per client query
  --max-cache-bogus-ttl=...
	maximum number of seconds to keep a Bogus (positive or negative) cached entry in memory
  --max-cache-entries=...
	If set, maximum number of entries in the main cache
  --max-cache-ttl=...
	maximum number of seconds to keep a cached entry in memory
  --max-chain-length=...
	maximum number of queries that can be chained to an outgoing request, 0 is no limit
  --max-cnames-followed=...
	Maximum number CNAME records followed
  --max-concurrent-requests-per-tcp-connection=...
	Maximum number of requests handled concurrently per TCP connection
  --max-dnskeys=...
	Maximum number of DNSKEYs with the same algorithm and tag to consider when validating a given record
  --max-ds-per-zone=...
	Maximum number of DS records to consider per zone
  --max-generate-steps=...
	Maximum number of $GENERATE steps when loading a zone from a file
  --max-include-depth=...
	Maximum nested $INCLUDE depth when loading a zone from a file
  --max-mthreads=...
	Maximum number of simultaneous Mtasker threads
  --max-negative-ttl=...
	maximum number of seconds to keep a negative cached entry in memory
  --max-ns-address-qperq=...
	Maximum outgoing NS address queries per query
  --max-ns-per-resolve=...
	Maximum number of NS records to consider to resolve a name, 0 is no limit
  --max-nsec3-hash-computations-per-query=...
	Maximum number of NSEC3 hashes that we are willing to compute during DNSSEC validation, per incoming query
  --max-nsec3s-per-record=...
	Maximum number of NSEC3s to consider when validating a given denial of existence
  --max-packetcache-entries=...
	maximum number of entries to keep in the packetcache
  --max-packetcache-entry-size=...
	maximum size of a packet stored in the the packet cache
  --max-qperq=...
	Maximum outgoing queries per client query
  --max-recordcache-entry-size=...
	maximum storage size of a recordset stored in record cache
  --max-recursion-depth=...
	Maximum number of internal recursion calls per query, 0 for unlimited
  --max-rrset-size=...
	Maximum size of RRSet in cache
  --max-rrsigs-per-record=...
	Maximum number of RRSIGs to consider when validating a given record
  --max-signature-validations-per-query=...
	Maximum number of RRSIG signatures we are willing to validate per incoming query
  --max-tcp-clients=...
	Maximum number of simultaneous TCP clients
  --max-tcp-per-client=...
	If set, maximum number of TCP sessions per client (IP address)
  --max-tcp-queries-per-connection=...
	If set, maximum number of TCP queries in a TCP connection
  --max-total-msec=...
	Maximum total wall-clock time per query in milliseconds, 0 for unlimited
  --max-udp-queries-per-round=...
	Maximum number of UDP queries processed per recvmsg() round, before returning back to normal processing
  --minimum-ttl-override=...
	The minimum TTL
  --negative-trustanchors=...
	A sequence of negative trust anchors
  --network-timeout=...
	Wait this number of milliseconds for network i/o
  --new-domain-db-size=...
	Size of the DB used to track new domains in terms of number of cells. Defaults to 67108864
  --new-domain-db-snapshot-interval=...
	Interval (in seconds) to write the NOD and UDR DB snapshots
  --new-domain-history-dir=...
	Persist new domain tracking data here to persist between restarts
  --new-domain-ignore-list=...
	List of domains (and implicitly all subdomains) which will never be considered a new domain
  --new-domain-ignore-list-file=...
	File with a list of domains (and implicitly all subdomains) which will never be considered a new domain
  --new-domain-log | --new-domain-log=yes | --new-domain-log=no
	Log newly observed domains.
  --new-domain-lookup=...
	Perform a DNS lookup newly observed domains as a subdomain of the configured domain
  --new-domain-pb-tag=...
	If protobuf is configured, the tag to use for messages containing newly observed domains. Defaults to 'pdns-nod'
  --new-domain-tracking | --new-domain-tracking=yes | --new-domain-tracking=no
	Track newly observed domains (i.e. never seen before).
  --no-shuffle | --no-shuffle=yes | --no-shuffle=no
	Don't change
  --non-local-bind | --non-local-bind=yes | --non-local-bind=no
	Enable binding to non-local addresses by using FREEBIND / BINDANY socket options
  --non-resolving-ns-max-fails=...
	Number of failed address resolves of a nameserver to start throttling it, 0 is disabled
  --non-resolving-ns-throttle-time=...
	Number of seconds to throttle a nameserver with a name failing to resolve
  --nothing-below-nxdomain=...
	When an NXDOMAIN exists in cache for a name with fewer labels than the qname, send NXDOMAIN without doing a lookup (see RFC 8020)
  --nsec3-max-iterations=...
	Maximum number of iterations allowed for an NSEC3 record
  --opentelemetry-trace-conditions=...
	Sequence of OpenTelemetryTraceCondition
  --out-any-to-tcp | --out-any-to-tcp=yes | --out-any-to-tcp=no
	Use TCP for ANY queries to authoritative servers
  --outgoing-cookies | --outgoing-cookies=yes | --outgoing-cookies=no
	Enable DNS cookies when contacting authoritative servers or forwarders
  --outgoing-cookies-unsupported=...
	Addresses (with optional port) of authoritative servers that do not support cookies
  --outgoing-protobuf-servers=...
	List of outgoing protobuf servers
  --packetcache-negative-ttl=...
	maximum number of seconds to keep a cached NxDomain or NoData entry in packetcache
  --packetcache-servfail-ttl=...
	maximum number of seconds to keep a cached servfail entry in packetcache
  --packetcache-shards=...
	Number of shards in the packet cache
  --packetcache-ttl=...
	maximum number of seconds to keep a cached entry in packetcache
  --pdns-distributes-queries | --pdns-distributes-queries=yes | --pdns-distributes-queries=no
	If PowerDNS itself should distribute queries over threads
  --processes=...
	Launch this number of processes (EXPERIMENTAL, DO NOT CHANGE)
  --protobuf-mask-v4=...
	Network mask to apply for client IPv4 addresses in protobuf messages
  --protobuf-mask-v6=...
	Network mask to apply for client IPv6 addresses in protobuf messages
  --protobuf-servers=...
	Sequence of protobuf servers
  --protobuf-use-kernel-timestamp | --protobuf-use-kernel-timestamp=yes | --protobuf-use-kernel-timestamp=no
	Compute the latency of queries in protobuf messages by using the timestamp set by the kernel when the query was received (when available)
  --proxy-protocol-exceptions=...
	A Proxy Protocol header should not be used for these listen addresses.
  --proxy-protocol-from=...
	A Proxy Protocol header is required from these subnets
  --proxy-protocol-maximum-size=...
	The maximum size of a proxy protocol payload, including the TLV values
  --proxymappings=...
	Sequence of ProxyMapping
  --public-suffix-list-file=...
	Path to the Public Suffix List file, if any
  --qname-max-minimize-count=...
	RFC9156 max minimize count
  --qname-minimization | --qname-minimization=yes | --qname-minimization=no
	Use Query Name Minimization
  --qname-minimize-one-label=...
	RFC9156 minimize one label parameter
  --query-local-address=...
	Source IP address for sending queries
  --quiet | --quiet=yes | --quiet=no
	Suppress logging of questions and answers
  --record-cache-locked-ttl-perc=...
	Replace records in record cache only after this % of original TTL has passed
  --record-cache-shards=...
	Number of shards in the record cache
  --refresh-on-ttl-perc=...
	If a record is requested from the cache and only this % of original TTL remains, refetch
  --reuseport | --reuseport=yes | --reuseport=no
	Enable SO_REUSEPORT allowing multiple recursors processes to listen to 1 address
  --rng=...

  --root-nx-trust | --root-nx-trust=yes | --root-nx-trust=no
	If set, believe that an NXDOMAIN from the root means the TLD does not exist
  --rpzs=...
	Sequence of RPZ entries
  --save-parent-ns-set | --save-parent-ns-set=yes | --save-parent-ns-set=no
	Save parent NS set to be used if child NS set fails
  --security-poll-suffix=...
	Domain name from which to query security update notifications
  --serve-rfc1918 | --serve-rfc1918=yes | --serve-rfc1918=no
	If we should be authoritative for RFC 1918 private IP space
  --serve-rfc6303 | --serve-rfc6303=yes | --serve-rfc6303=no
	If we should be authoritative for RFC 6303 private IP space
  --serve-stale-extensions=...
	Number of times a record's ttl is extended by 30s to be served stale
  --server-down-max-fails=...
	Maximum number of consecutive timeouts (and unreachables) to mark a server as down ( 0 => disabled )
  --server-down-throttle-time=...
	Number of seconds to throttle all queries to a server after being marked as down
  --server-id=...
	Returned when queried for 'id.server' TXT or NSID, defaults to hostname, set custom or 'disabled'
  --setgid=...
	If set, change group id to this gid for more security
  --setuid=...
	If set, change user id to this uid for more security
  --signature-inception-skew=...
	Allow the signature inception to be off by this number of seconds
  --single-socket | --single-socket=yes | --single-socket=no
	If set, only use a single socket for outgoing queries
  --snmp-agent | --snmp-agent=yes | --snmp-agent=no
	If set, register as an SNMP agent
  --snmp-daemon-socket=...
	If set and snmp-agent is set, the socket to use to register to the SNMP daemon
  --soa-minimum-ttl=...
	Don't change
  --socket-dir=...
	Where the controlsocket will live, /var/run/pdns-recursor when unset and not chrooted
  --socket-group=...
	Group of socket
  --socket-mode=...
	Permissions for socket
  --socket-owner=...
	Owner of socket
  --sortlists=...
	Sequence of sort lists
  --spoof-nearmiss-max=...
	If non-zero, assume spoofing after this many near misses
  --stack-cache-size=...
	Size of the stack cache, per mthread
  --stack-size=...
	stack size per mthread
  --statistics-interval=...
	Number of seconds between printing of recursor statistics, 0 to disable
  --stats-api-disabled-list=...
	List of statistics that are disabled when retrieving the complete list of statistics via the API
  --stats-carbon-disabled-list=...
	List of statistics that are prevented from being exported via Carbon
  --stats-rec-control-disabled-list=...
	List of statistics that are prevented from being exported via rec_control get-all
  --stats-ringbuffer-entries=...
	maximum number of packets to store statistics for
  --stats-snmp-disabled-list=...
	List of statistics that are prevented from being exported via SNMP
  --structured-logging | --structured-logging=yes | --structured-logging=no
	Prefer structured logging
  --structured-logging-backend=...
	Structured logging backend
  --system-resolver-interval=...
	Set interval (in seconds) of the re-resolve checks of system resolver subsystem.
  --system-resolver-self-resolve-check | --system-resolver-self-resolve-check=yes | --system-resolver-self-resolve-check=no
	Check for potential self-resolve, default enabled.
  --system-resolver-ttl=...
	Set TTL of system resolver feature, 0 (default) is disabled
  --tcp-fast-open=...
	Enable TCP Fast Open support on the listening sockets, using the supplied numerical value as the queue size
  --tcp-fast-open-connect | --tcp-fast-open-connect=yes | --tcp-fast-open-connect=no
	Enable TCP Fast Open support on outgoing sockets
  --tcp-out-max-idle-ms=...
	Time TCP/DoT connections are left idle in milliseconds or 0 if no limit
  --tcp-out-max-idle-per-auth=...
	Maximum number of idle TCP/DoT connections to a specific IP per thread, 0 means do not keep idle connections open
  --tcp-out-max-idle-per-thread=...
	Maximum number of idle TCP/DoT connections per thread
  --tcp-out-max-queries=...
	Maximum total number of queries per TCP/DoT connection, 0 means no limit
  --tcp-threads=...
	Launch this number of threads listening for and processing TCP queries
  --threads=...
	Launch this number of threads
  --tls-configurations=...
	Sequence of OutgoingTLSConfiguration
  --trace=...
	if we should output heaps of logging. set to 'fail' to only log failing domains
  --trustanchorfile=...
	A path to a zone file containing trust anchors
  --trustanchorfile-interval=...
	Interval (in hours) to read the trust anchors file
  --trustanchors=...
	Sequence of trust anchors
  --udp-source-port-avoid=...
	List of comma separated UDP port numbers to avoid
  --udp-source-port-max=...
	Maximum UDP port to bind on
  --udp-source-port-min=...
	Minimum UDP port to bind on
  --udp-truncation-threshold=...
	Maximum UDP response size before we truncate
  --unique-response-db-size=...
	Size of the DB used to track unique responses in terms of number of cells. Defaults to 67108864
  --unique-response-history-dir=...
	Persist unique response tracking data here to persist between restarts
  --unique-response-ignore-list=...
	List of domains (and implicitly all subdomains) which will never be considered for UDR
  --unique-response-ignore-list-file=...
	File with list of domains (and implicitly all subdomains) which will never be considered for UDR
  --unique-response-log | --unique-response-log=yes | --unique-response-log=no
	Log unique responses
  --unique-response-pb-tag=...
	If protobuf is configured, the tag to use for messages containing unique DNS responses. Defaults to 'pdns-udr'
  --unique-response-tracking | --unique-response-tracking=yes | --unique-response-tracking=no
	Track unique responses (tuple of query name, type and RR).
  --use-incoming-edns-subnet | --use-incoming-edns-subnet=yes | --use-incoming-edns-subnet=no
	Pass along received EDNS Client Subnet information
  --version
	Print version string
  --version-string=...
	string reported on version.pdns or version.bind
  --webserver | --webserver=yes | --webserver=no
	Start a webserver (for REST API)
  --webserver-address=...
	IP Address of webserver to listen on
  --webserver-allow-from=...
	Webserver access is only allowed from these subnets
  --webserver-hash-plaintext-credentials | --webserver-hash-plaintext-credentials=yes | --webserver-hash-plaintext-credentials=no
	Whether to hash passwords and api keys supplied in plaintext, to prevent keeping the plaintext version in memory at runtime
  --webserver-loglevel=...
	Amount of logging in the webserver (none, normal, detailed)
  --webserver-max-request-size=...
	Maximum size for webserver requests in megabytes
  --webserver-password=...
	Password required for accessing the webserver
  --webserver-port=...
	Port of webserver to listen on
  --write-pid | --write-pid=yes | --write-pid=no
	Write a PID file
  --x-dnssec-names=...
	Collect DNSSEC statistics for names or suffixes in this list in separate x-dnssec counters
  --zonetocaches=...
	Sequence of ZoneToCache entries