PFRESOLVED(8)

NAME
pfresolved - resolve hostnames using DNS and update pf tables

SYNOPSIS
pfresolved [-dnTv] [-A trust_anchor_file] [-C cert_bundle_file] [-f file] [-h hints_file] [-i outbound_ip] [-M seconds] [-m seconds] [-r resolver] [-S dnssec_level] [-s socket]

DESCRIPTION
pfresolved is a daemon which resolves hostnames using DNS and updates pf(4) tables with the result.

The options are as follows:

-A trust_anchor_file
    Path to a file containing the trust anchors used for DNSSEC validation. The file can contain both DS and DNSKEY entries in the standard DNS zone file format.

-C cert_bundle_file
    Path to a file containing certificates that are used to authenticate resolvers if DNS-over-TLS is enabled.

-d  Do not daemonize and log to stderr.

-f file
    The config file to use. Default is /etc/pfresolved.conf.

-h hints_file
    Path to a file that is filled with the latest resolve results. The file is written when pfresolved receives a SIGHUP, SIGUSR1, SIGINT, or SIGTERM.

-i outbound_ip
    IP address that is used to connect to resolvers.

-M seconds
    Minimum time in seconds to wait between consecutive successful resolve requests for a host. Default is 10 seconds.

-m seconds
    Maximum time in seconds to wait between consecutive successful resolve requests for a host. Default is 86400 seconds.

-n  Only check the configuration file for validity and then exit.

-r resolver
    IP address of the recursive resolver that DNS requests should be forwarded to. To use a port other than 53 append '@' and the port number. If DNS-over-TLS is used a '#' and a name can be appended, then the certificate will be authenticated with the given name. Using '#' requires first specifying the port with '@'.

    This option can be given multiple times to configure multiple resolvers.

-S dnssec_level
    Used to configure DNSSEC. Levels above 0 require that a valid trust anchor is configured with -A.

    Possible levels are:

    0   DNSSEC is disabled.

    1   DNSSEC is enabled but validation failures are only warned about and otherwise ignored.

        Note: This option can actually be less restrictive than disabling DNSSEC if the configured resolvers do DNSSEC validation themselves. If validation fails on the resolver and DNSSEC is disabled the queries will be answered with SERVFAIL causing the resolve to just fail. If DNSSEC is enabled the queries would be sent again, this time asking the resolver to disable DNSSEC validation. This gives pfresolved the option to do the DNSSEC validation itself and allows ignoring validation failures.

    2   DNSSEC is enabled and validation failures cause the query result to be discarded. Results from zones that are not signed with DNSSEC are still allowed.

    3   DNSSEC is enabled and required for every zone. Unsigned query results will be discarded.

-s socket
    The control socket to use. Default is /var/run/pfresolved.sock.

-T  Enable DNS-over-TLS. The system certificates will be automatically included and used for authentication unless a certificate bundle is specified using -C.

-v  Produce more verbose output. Can be specified multiple times to increase the verbosity.

SEE ALSO
pf(4), pfresolved.conf(5)

AUTHORS
Carsten Beckmann