Chapter 10: Keep it running

Why

You're the operator now. A resolver that nobody updates becomes a risk, and one that quietly stops blocking is worse than none, because you think you're protected. Most of the upkeep runs by itself. This chapter shows what does, what doesn't, and a ten-minute check once a month.

What runs by itself

What doesn't

• dnsdist and Recursor updates. They come from PowerDNS's package source, and unattended-upgrades installs only Ubuntu's own security updates by default. Update them yourself (monthly check, step 2).
• Restarts after kernel updates. Updates install by themselves, but a new kernel only runs after a restart.
• Noticing that something broke. Nothing tells you. The monthly check does. If you want to know sooner, a small script on another machine you run can ask your resolver every few minutes and warn you when it stops answering or stops blocking. That's what we do, but it's optional for a household.

The monthly check (about 10 minutes)

1. On your iPhone

Run the three checks from chapter 8: dnsleaktest shows only your server, google-analytics.com doesn't load, a normal site does. With your VPN on, run the checks from chapter 9 too.

2. On the server

ssh dns@<your-server-ip>

Update everything, including dnsdist and Recursor:

sudo apt update
sudo apt upgrade

Restart if the server asks for it:

[ -f /var/run/reboot-required ] && echo "restart needed"

If it says so: sudo reboot, wait a minute, and log in again.

Check that everything runs:

systemctl is-active pdns-recursor dnsdist
systemctl list-timers certbot.timer dns-lists.timer

Both services active; both timers show a next run.

Check that the lists are current:

ls -l /etc/powerdns/rpz/
cat /var/lib/dns-lists/*.count

The .rpz files are at most a day or two old, and the counts look like last month's. The update script's own messages stay in the log for less than a day, by design (chapter 7); the file dates are what lasts.

Check the certificate:

sudo openssl x509 -in /etc/dnsdist/tls/fullchain.pem -noout -enddate

The end date is more than about 10 days ahead. Certbot renews when about a third of the certificate's lifetime is left, so with today's 90-day certificates the end date is usually 30 to 90 days ahead, and with 64-day certificates (from February 2027) about 21 to 64 days. Under 10 days means renewal is failing: run sudo certbot renew --dry-run to see why.

3. After every iOS update

Run the chapter 8 and 9 checks again. As far as we know, Apple doesn't document which DNS wins when a profile and a VPN are both active, so an update could change it. And the profile itself has an end date (chapter 8).

The yearly check (about 30 minutes)

Your package sources stay on dnsdist 2.1 and Recursor 5.4 until you change them (chapter 4). Once a year:

1. Look up PowerDNS's end-of-life pages for dnsdist and Recursor (on doc.powerdns.com). If your version is past "critical fixes only", it's time to move.
2. Change the version in your two source files (/etc/apt/sources.list.d/pdns-rec.list and pdns-dnsdist.list), for example rec-54 to the next version.
3. Read that version's upgrade notes for settings that changed.
4. sudo apt update && sudo apt upgrade, then run all checks from chapters 4 to 7.

Keep a copy of your settings

Your server holds no data about you or anyone else, so there's nothing to back up except your own settings. With them, you can rebuild the server in an hour by following chapters 3 to 7 again.

From your Mac:

ssh dns@<your-server-ip> 'sudo tar -cz \
  /etc/dnsdist/dnsdist.conf \
  /etc/powerdns/recursor.d \
  /etc/powerdns/rpz/allow.rpz \
  /etc/dns-lists \
  /usr/local/sbin/dns-lists-update \
  /usr/local/sbin/dnsdist-cert-deploy \
  /etc/systemd/system/dns-lists.service \
  /etc/systemd/system/dns-lists.timer \
  /etc/systemd/journald.conf.d/zz-privacy.conf' > dns-server-settings.tar.gz

• It contains your private path: keep it like a key, for example in your password manager as an attachment.
• It doesn't contain the certificate or its key. A rebuilt server simply gets a new certificate (chapter 5).
• A rebuilt server usually gets new IP addresses. Then update the A and AAAA records at deSEC (chapter 5), and install a new profile on every device (chapter 8), because the profile contains the old addresses. Some providers let you keep an address when you replace a server; check yours.

Take a new copy whenever you change a setting.

Pitfalls

• "It works" isn't the same as "it blocks". A broken list update or a VPN that took over the DNS leaves your internet working fine, only without protection. That's why every check includes a blocked name.
• Your home IP changed, and SSH stops working. Update the firewall rule at your server provider (chapter 3).
• The cheapest server line may be sold out when you rebuild. Take the next size; the settings are the same.

Time and cost

• About 10 minutes a month.
• No extra cost.

---

Previous: Chapter 9: Your DNS inside your VPN · Next: Chapter 11: If family or friends use it

Text: CC BY-SA 4.0 · Commands and configs: CC0