hi all, recently migrated to vyos so apologies if this already exists and i am just too stupid to find it

i'm fumbling my way around PowerDNS and found out i couldn't configure these 4 settings manually so i would like to request their inclusion

Summary

Add support for exposing the following PowerDNS Recursor options under service dns forwarding in VyOS Stream:

refresh-on-ttl-perc
nothing-below-nxdomain
minimum-ttl-override
RPZ / Response Policy Zones

Suggested CLI syntax:

set service dns forwarding refresh-on-ttl-perc <0-100>
set service dns forwarding nothing-below-nxdomain <no|dnssec|yes>
set service dns forwarding minimum-ttl-override <seconds>

Suggested CLI syntax for RPZ support:

set service dns forwarding rpz zone <name> file <path>
set service dns forwarding rpz zone <name> policy <nxdomain|nodata|drop|passthru|custom>
set service dns forwarding rpz zone <name> policy-name <name>

Optionally, if network-transferred RPZ zones are in scope:

set service dns forwarding rpz zone <name> primary <address>
set service dns forwarding rpz zone <name> zone-name <rpz-zone-name>
set service dns forwarding rpz zone <name> tsig-key <key-name>

I am not attached to the exact CLI structure above; it is just intended as a possible shape for exposing the existing PowerDNS Recursor functionality through VyOS.

Use case

VyOS Stream uses PowerDNS Recursor for DNS forwarding, but these useful cache-control options are not currently exposed through the VyOS configuration CLI.

RPZ support would allow VyOS’ native DNS forwarding service to apply local DNS response policy. This could be used for DNS-based ad blocking, malware domain blocking, phishing protection, local policy enforcement, or integrating third-party RPZ feeds.

RPZ-specific use case

PowerDNS Recursor already supports RPZ through Lua configuration using functions such as rpzFile() and rpzPrimary().

Example use cases:

DNS-based ad blocking
malware / phishing / C2 domain blocking
local policy blocklists
RPZ feeds from external providers
internally maintained blocklists
safer integration with generated Recursor configuration

Example generated PowerDNS Recursor Lua configuration could look conceptually like:

rpzFile("/config/dns/rpz/hagezi.rpz", {
  policyName = "hagezi",
  defpol = Policy.NXDOMAIN,
  ignoreDuplicates = true
})

Or, for transferred RPZ zones:

rpzPrimary("192.0.2.53", "rpz.example.internal", {
  policyName = "internal-rpz",
  defpol = Policy.NXDOMAIN
})

These options would allow administrators to tune DNS resolver behaviour more effectively.

refresh-on-ttl-perc allows popular cached records to be refreshed before they fully expire, reducing latency spikes for frequently requested domains.
nothing-below-nxdomain enables RFC 8020-style handling of NXDOMAIN responses, allowing the resolver to avoid unnecessary upstream queries for names below an already-known non-existent domain.
minimum-ttl-override allows very low TTL records to be cached for a configurable minimum period, improving cache efficiency and reducing repeated upstream lookups.
This is useful for networks where VyOS acts as the local DNS forwarder for clients, especially in home labs, branch networks, small offices, or networks with noisy clients generating many DNS queries.

Additional information

I am using VyOS Stream rather than rolling.

These options are already supported by PowerDNS Recursor, so the request is to expose them through the VyOS CLI and render them into the generated Recursor configuration.

Suggested defaults could preserve current PowerDNS Recursor behaviour:

refresh-on-ttl-perc: 0
nothing-below-nxdomain: dnssec
minimum-ttl-override: 1

Example generated PowerDNS Recursor configuration:

refresh-on-ttl-perc=10
nothing-below-nxdomain=dnssec
minimum-ttl-override=30

Example VyOS configuration:

set service dns forwarding listen-address 192.168.1.1
set service dns forwarding allow-from 192.168.1.0/24
set service dns forwarding name-server 1.1.1.1
set service dns forwarding cache-size 100000
set service dns forwarding refresh-on-ttl-perc 10
set service dns forwarding nothing-below-nxdomain dnssec
set service dns forwarding minimum-ttl-override 30
set service dns forwarding rpz zone hagezi file /config/dns/rpz/hagezi.rpz
set service dns forwarding rpz zone hagezi policy nxdomain

Are there any limitations to using the feature (hardware support, resource usage)?
some will make a few more dns queries happen, some will make less

RPZ can increase memory usage depending on the size of the policy zones. Large RPZ feeds may also increase reload time.

Are there any adverse or non-obvious interactions with other features? Should the feature be mutually exclusive?

RPZ has some possible interactions worth documenting:

DNSSEC validation may interact with response rewriting, depending on the configured RPZ policy and Recursor behaviour.
RPZ should probably be disabled by default.
Large RPZ files may have memory and reload-time impact.
If both static RPZ files and transferred RPZ zones are supported, the ordering/priority of policy zones should be documented.
If an RPZ zone fails to load, it would be useful for commit validation or service logs to make that clear.

Any relevant documentation or references about the feature.

https://doc.powerdns.com/recursor/settings.html#refresh-on-ttl-perc
https://doc.powerdns.com/recursor/settings.html#nothing-below-nxdomain
https://doc.powerdns.com/recursor/settings.html#minimum-ttl-override

https://doc.powerdns.com/recursor/lua-config/rpz.html