Blacklisting domains using PowerDNS Recursor

I recently had a client that was wanting to provide a recursive DNS service within his company, however wanted to blacklist a lot of domains to redirect internally. And I mean a lot – over 1 million porn/spam/… domains. It’s one thing to use the excellent unbound recursive DNS software and set up the blocks using the local-data argument, but it was requiring over 6gb of memory to load the list and crashing the process because of that.

As it turns out, yet again PowerDNS to the rescue. I love PowerDNS for its flexibility (so much so that I created a very high performance DNS backend for it and also run a company consulting on DNS deployments).

As the full list of domains would not fit in memory we had to use a database, I took inspiration from a previously posted Lua script which used a tinycdb. Unfortunately tinycdb requires manual compilation and so wasn’t an option, and as the client already had the list of domains in a MySQL deployment we ended up using that. Both PowerDNS authoritative server and recursor can support Lua scripting to do pretty much anything you need, and there are a number of database options that Lua can use. I started off using luadbi as it seemed to have a nicer interface, however unfortunately luadbi only supports lua 5.1 whereas the debian build of PowerDNS uses lua 5.2. This meant switching to use luasql which is a bit lower-level.

So, the following Lua script will redirect any blacklisted subdomains (in the mysql table domains with field name) to

driver = require "luasql.mysql"
env = assert( driver.mysql() )

function preresolve ( remoteip, domain, qtype )
        con = assert(env:connect("database_name", 'username', 'password'))

        domain = domain:gsub("%.$", "")

        while domain ~= "" do
                local sth = assert (con:execute( string.format("SELECT 1 FROM domains WHERE name = '%s'", con:escape( domain )) ) )
                if sth:fetch() then 
                        return 0, { { qtype=pdns.A, content="" } }

                domain = domain:gsub("^[^.]*%.?", "")

        return -1, {}

As establishing a MySQL connection each request is quite a high overhead it might well be worth switching to use SQLite in the future, this should be very simple to do by just changing the driver name and connection string.

5 thoughts on “Blacklisting domains using PowerDNS Recursor”

  1. Do you list the subdomains in the SQL table or do you use regex/wildcards to match all subdomains?

    Asking as I’m trying to block all access to any queries to the domain and all subdomains. As I don’t know all the subdomains for these domains I’ve been looking to see if I can use regex in :check(dg.gname), but I’ve not found much helpful information yet.

    Thank you for your blog, it’s proving to be quite a helpful resource!

  2. “As establishing a MySQL connection each request is quite a high overhead”

    dont instantiate the connection in a local scope, do it in the global its still a resource hog, but less so.

  3. Is there a newer version of the script, i have error:

    STL error (/A from [string “chunk”]:7: attempt to index local ‘domain’ (a nil value)
    ubuntu 20 pdns-recursor 4.2.1

    Thanks 🙂

Leave a Reply

Your email address will not be published. Required fields are marked *