When PowerDNS auth is not configured for resolution, PowerDNS recursor can request public DNS.

[airsmon]

Enterprises deploy PowerDNS Auth and PowerDNS Recursor internally. When test.sample.com is not configured in Auth and has resolution records in public network DNS. How should recursor be configured
1，When requesting a recursor, you first query it in Auth. If no one is found, you will continue to return the result to the public network DNS request

• zone: sample.com
  recurse: true
  notify_allowed: true
  forwarders:
  • 10.64.40.40
  • 8.8.8.8

[treemanou]

/etc/powerdns/recursor.yml

recursor:
  lua_dns_script: /etc/powerdns/lua.conf
  extended_resolution_errors: true
  forward_zones_recurse:
    - zone: sample.com
      forwarders:
        - 10.64.40.40:53
        - 8.8.8.8:53
    - zone: .
      forwarders:
        - 8.8.8.8:53
        - 1.1.1.1:53

/etc/powerdns/lua.conf

function nxdomain(dq)
        pdnslog("[NXDOMAIN] fallback trigger for " .. dq.qname:toString())
        dq.variable = true
        return false
end