PowerDNS Authoritative Server - DNS API and DNSSEC - AMI by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

PowerDNS Authoritative Server is a high performance open source authoritative DNS server used to host the DNS zones for your own domains. It answers queries for the domains you are authoritative for, rather than resolving names on behalf of clients, which makes it the server you run to publish your DNS records to the internet. This image delivers PowerDNS fully installed and configured against a MariaDB database backend, with the REST API and DNSSEC tooling ready to use, so a working authoritative name server is running within minutes of launch and you skip hours of manual DNS server setup and hardening.

PowerDNS stores its zones and records in a relational MariaDB database, so you manage DNS with SQL, the pdnsutil command line tool, or the built in REST API rather than editing flat zone files by hand. The REST API is the same interface used by web control panels and automation tools, so you can create zones, add records and rotate DNSSEC keys programmatically. DNSSEC signing is built in and can be enabled per zone with a single command.

Application stack: PowerDNS runs as a hardened systemd service answering DNS on port 53 over both UDP and TCP across all interfaces. Its zone data lives in a MariaDB database on the same instance. The REST API and status webserver bind to loopback on port 8081 and are authenticated with a per instance API key, so the management surface is never exposed to the network while DNS itself serves the internet. The systemd-resolved stub listener is disabled so PowerDNS owns port 53 cleanly, and the operating system continues to resolve names through the upstream resolver list.

Secure by default: no default or shared credentials ship in the image. On the first boot of your instance a one shot service generates a unique REST API key and a unique database password, writes them to a root only file, provisions a demonstration zone so DNS answers immediately, and verifies the API key round trips before completing. The API rejects unauthenticated requests.

Key capabilities: authoritative DNS for unlimited zones and records backed by MariaDB; a full REST API for programmatic zone and record management; built in DNSSEC signing with NSEC and NSEC3 support and one command key generation; the pdnsutil administration tool for zones, records, DNSSEC and metadata; zone transfers (AXFR and IXFR) for secondary name servers; and SQL level access to your DNS data for reporting and bulk changes.

Get started: retrieve the per instance REST API key from the root only credentials file, replace the demonstration example.com zone with your own domain, add your records with pdnsutil or the REST API, optionally enable DNSSEC, then point your domain registrar's name server records at this instance's public IP. cloudimg engineers can walk you through zone migration, DNSSEC and secondary name server setup after purchase.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.