## `allow-from-file`
* Path
+* Available since: 3.1.5
Like [`allow-from`](#allow-from), except reading from file. Overrides the
[`allow-from`](#allow-from) setting. To use this feature, supply one netmask per
## `any-to-tcp`
* Boolean
* Default: no
+* Available since: 3.6.0
Answer questions for the ANY type on UDP with a truncated packet that refers the
remote server to TCP. Useful for mitigating ANY reflection attacks.
## `api-readonly`
* Boolean
* Default: no
-* Available since: 4.0
+* Available since: 4.0.0
Disallow data modification through the REST API when set.
## `api-logfile`
* Path
* Default: unset
-* Available since: 4.0
+* Available since: 4.0.0
Location of the server logfile (used by the REST API).
## `carbon-interval`
* Integer
* Default: 30
-* Available since: 3.5.3
+* Available since: 3.6.0
If sending carbon updates, this is the interval between them in seconds. See
["PowerDNS Metrics"](../common/logging.md#sending-to-carbongraphitemetronome).
## `carbon-ourname`
* String
-* Available since: 3.5.3
+* Available since: 3.6.0
If sending carbon updates, if set, this will override our hostname. Be
careful not to include any dots in this setting, unless you know what you
## `carbon-server`
* IP address
-* Available since: 3.5.3
+* Available since: 3.6.0
If set to an IP or IPv6 address, will send all available metrics to this server
via the carbon protocol, which is used by graphite and metronome. You may specify
## `chroot`
* Path to a Directory
+
If set, chroot to this directory for more security. See [Security](../common/security.md).
Make sure that `/dev/log` is available from within the chroot. Logging will
## `config-name`
* String
* Default: unset
+* Available since: 3.6.0
When running multiple recursors on the same server, read settings from
"recursor-name.conf", this will also rename the binary image.
## `disable-syslog`
* Boolean
* Default: no
+* Available since: 4.0.0
Do not log to syslog, only to stdout. Use this setting when running inside a
supervisor that handles logging (like systemd). **Note**: do not use this setting
## `ecs-ipv4-bits`
* Integer
* Default: 24
-* Available since 4.1
+* Available since: 4.1.0
Number of bits of client IPv4 address to pass when sending EDNS Client Subnet address information.
## `ecs-ipv6-bits`
* Integer
* Default: 56
-* Available since 4.1
+* Available since: 4.1.0
Number of bits of client IPv6 address to pass when sending EDNS Client Subnet address information.
## `edns-outgoing-bufsize`
* Integer
* Default: 1680
+* Available since: 4.0.0
This is the value set for the EDNS0 buffer size in outgoing packets.
Lower this if you experience timeouts.
## `edns-subnet-whitelist`
* Comma separated list of domain names and netmasks
* Default: (none)
+* Available since: 4.0.0
List of netmasks and domains that [EDNS Client Subnet](https://tools.ietf.org/html/rfc7871) should be enabled for in outgoing queries.
For example, an EDNS Client Subnet option containing the address of the initial requestor will be added to an outgoing query sent to server 192.0.2.1 for domain X if 192.0.2.1 matches one of the supplied netmasks, or if X matches one of the supplied domains.
## `etc-hosts-file`
* Path
* Default: /etc/hosts
+* Available since: 3.2
The path to the /etc/hosts file, or equivalent. This file can be used to serve
data authoritatively using [`export-etc-hosts`](#export-etc-hosts).
## `hint-file`
* Path
-* Available since: 2.9.19
If set, the root-hints are read from this file. If unset, default root hints are
used.
## `lua-config-file`
* Filename
-* Available since 4.0.0
+* Available since: 4.0.0
If set, and Lua support is compiled in, this will load an additional configuration file
for newer features and more complicated setups.
## `lua-dns-script`
* Path
* Default: unset
+* Available since: 3.1.7
Path to a lua file to manipulate the recursor's answers. See [Scripting the
recursor](scripting.md).
## `max-recursion-depth`
* Integer
* Default: 40 (since 4.1.0), unlimited (before 4.1.0)
+* Available since: 4.0.4
Total maximum number of internal recursion calls the server may use to answer
a single query. 0 means unlimited. The value of `stack-size` should be increased
## `max-tcp-queries-per-connection`
* Integer
* Default: 0 (unlimited)
+* Available since: 4.1.0
Maximum number of DNS queries in a TCP connection.
## `max-total-msec`
* Integer
* Default: 7000
+* Available since: 3.7.1
Total maximum number of milliseconds of wallclock time the server may use to answer
a single query.
## `minimum-ttl-override`
* Integer
* Default: 0 (disabled)
+* Available since: 3.6.0
This setting artificially raises all TTLs to be at least this long. While this
is a gross hack, and violates RFCs, under conditions of DoS, it may enable you
## `pdns-distributes-queries`
* Boolean
* Default: yes (since 3.7.0), no (before 3.7.0)
-* Available since: 3.6
+* Available since: 3.3
If set, PowerDNS will have only 1 thread listening on client sockets, and
distribute work by itself over threads. Improves performance on Linux. Do not
## `query-local-address`
* IPv4 Address, comma separated
* Default: 0.0.0.0
-* Available since: 3.2
Send out local queries from this address, or addresses, by adding multiple
addresses, increased spoofing resilience is achieved.
## `query-local-address6`
* IPv6 addresses, comma separated
* Default: unset
-* Available since: 3.2
+* Available since: 3.1
Send out local IPv6 queries from this address or addresses. Disabled by default,
which also disables outgoing IPv6 support.
## `root-nx-trust`
* Boolean
* Default: no (<= 4.0.0), yes
+* Available since: 3.7.1
If set, an NXDOMAIN from the root-servers will serve as a blanket NXDOMAIN for the entire TLD
the query belonged to. The effect of this is far fewer queries to the root-servers.
## `serve-rfc1918`
* Boolean
* Default: yes
+* Available since: 3.6.2
This makes the server authoritatively aware of: `10.in-addr.arpa`,
`168.192.in-addr.arpa`, `16-31.172.in-addr.arpa`, which saves load on the AS112
## `server-down-max-fails`
* Integer
* Default: 64
-* Available since: 3.6
+* Available since: 3.6.0
If a server has not responded in any way this many times in a row, no longer
send it any queries for [`server-down-throttle-time`](#server-down-throttle-time)
## `server-down-throttle-time`
* Integer
* Default: 60
-* Available since: 3.6
+* Available since: 3.6.0
Throttle a server that has failed to respond [`server-down-max-fails`](#server-down-max-fails)
times for this many seconds.
When using [`chroot`](#chroot) the default becomes to `/`.
## `socket-owner`, `socket-group`, `socket-mode`
+* Available since: 3.2
+
Owner, group and mode of the controlsocket. Owner and group can be specified by
name, mode is in octal.
## `stack-size`
* Integer
* Default: 200000
+* Available since: 3.1.3
Size of the stack per thread.
## `stats-ringbuffer-entries`
* Integer
* Default: 10000
+* Available since: 3.7.1
Number of entries in the remotes ringbuffer, which keeps statistics on who is
querying your server. Can be read out using `rec_control top-remotes`.
## `threads`
* Integer
* Default: 2
+* Available since: 3.2
Spawn this number of threads on startup.
## `udp-truncation-threshold`
* Integer
* Default: 1680
+* Available since: 3.6.0
EDNS0 allows for large UDP response datagrams, which can potentially raise
performance. Large responses however also have downsides in terms of reflection
`ecs-ipv4-bits` for IPv4 or `ecs-ipv6-bits` for IPv6.
## `version`
+* Available since: 3.1.5
+
Print version of this binary. Useful for checking which version of the PowerDNS
recursor is installed on a system. Available since version 3.1.5.
## `webserver`
* Boolean
* Default: no
+* Available since: 4.0.0
Start the webserver (for REST API).
## `webserver-address`
* IP Addresses, separated by spaces
* Default: 127.0.0.1
+* Available since: 4.0.0
IP address for the webserver to listen on.
## `webserver-allow-from`
* IP addresses, comma separated
* Default: 0.0.0.0, ::/0
+* Available since: 3.7.1
These subnets are allowed to access the webserver.
## `webserver-password`
* String
* Default: unset
+* Available since: 4.0.0
Password required to access the webserver.
## `webserver-port`
* Integer
* Default: 8082
+* Available since: 4.0.0
TCP port where the webserver should listen on.
## `write-pid`
* Boolean
* Default: yes
+* Available since: 4.0.0
If a PID file should be written. Available since 4.0.