The first mararc variable that needs to be set is tcp_convert_acl. This is a list of IPs that are allowed to make DNS-over-TCP queries. In the case of using MaraDNS as an authoritative nameserver, this should have a value of "0.0.0.0/0" (anyone on the internet can make TCP DNS connections). If MaraDNS is being used as a recursive or upstream server, this should have the same value that the recursive_acl mararc variable has. In the case of MaraDNS being both a recursive and authoritative DNS server, tcp_convert_acl should have a value of "0.0.0.0/0"--this is not a security hazard since the zoneserver will only send UDP packets that request recursion if the client that connects to the TCP server is on the recursive_acl list.
The second mararc variable that needs to be set is tcp_convert_server. This is the IP of the UDP DNS server that we will connect whenever we get a DNS-over-TCP request. The way we perform DNS over TCP is as follows:
This is what a mararc file which serves the domain example.com and will provide both DNS over UDP and TCP will look like:
ipv4_bind_addresses = "10.1.2.3"
chroot_dir = "/etc/maradns"
csv2 = {}
csv2["example.com."] = "db.example.com"
tcp_convert_acl = "0.0.0.0/0"
tcp_convert_server = "10.1.2.3"
With this mararc file, and the csv2 zone file "db.example.com" in the
directory /etc/maradns, the program maradns will process
UDP DNS queries, and zoneserver will process TCP DNS queries.
maradns is a standalone UDP DNS server; zoneserver is a
TCP proxy that converts TCP requests in to UDP requests. Both daemons
must be running to process both UDP and TCP DNS queries.
This is what a recursive mararc file which provides recursive DNS over TCP and UDP will look like:
ipv4_bind_addresses = "10.1.2.3" chroot_dir = "/etc/maradns" recursive_acl = "10.0.0.0/8" tcp_convert_acl = "10.0.0.0/8" tcp_convert_server = "10.1.2.3"If both maradns and zoneserver are running, this mararc file will provide recursive DNS for anyone with an IP starting with the number "10" (this is a special network for private IPs) on a machine with the IP 10.1.2.3.