hi all, recently migrated to vyos so apologies if this already exists and i am just too stupid to find it
i'm fumbling my way around PowerDNS and found out i couldn't configure these 3 settings manually so i would like to request their inclusion
**Summary**
Add support for exposing the following PowerDNS Recursor options under `service dns forwarding` in VyOS Stream:
`refresh-on-ttl-perc`
`nothing-below-nxdomain`
`minimum-ttl-override`
Suggested CLI syntax:
`set service dns forwarding refresh-on-ttl-perc <0-100>`
`set service dns forwarding nothing-below-nxdomain <no|dnssec|yes>`
`set service dns forwarding minimum-ttl-override <seconds>`
**Use case**
VyOS Stream uses PowerDNS Recursor for DNS forwarding, but these useful cache-control options are not currently exposed through the VyOS configuration CLI.
These options would allow administrators to tune DNS resolver behaviour more effectively.
`refresh-on-ttl-perc` allows popular cached records to be refreshed before they fully expire, reducing latency spikes for frequently requested domains.
`nothing-below-nxdomain` enables RFC 8020-style handling of NXDOMAIN responses, allowing the resolver to avoid unnecessary upstream queries for names below an already-known non-existent domain.
`minimum-ttl-override` allows very low TTL records to be cached for a configurable minimum period, improving cache efficiency and reducing repeated upstream lookups.
This is useful for networks where VyOS acts as the local DNS forwarder for clients, especially in home labs, branch networks, small offices, or networks with noisy clients generating many DNS queries.
**Additional information**
I am using VyOS Stream rather than rolling.
These options are already supported by PowerDNS Recursor, so the request is to expose them through the VyOS CLI and render them into the generated Recursor configuration.
Suggested defaults could preserve current PowerDNS Recursor behaviour:
`refresh-on-ttl-perc: 0`
`nothing-below-nxdomain: dnssec`
`minimum-ttl-override: 1`
Example generated PowerDNS Recursor configuration:
`refresh-on-ttl-perc=10`
`nothing-below-nxdomain=dnssec`
`minimum-ttl-override=30`
Example VyOS configuration:
`set service dns forwarding listen-address 192.168.1.1`
`set service dns forwarding allow-from 192.168.1.0/24`
`set service dns forwarding name-server 1.1.1.1`
`set service dns forwarding cache-size 100000`
`set service dns forwarding refresh-on-ttl-perc 10`
`set service dns forwarding nothing-below-nxdomain dnssec`
`set service dns forwarding minimum-ttl-override 30`
**Are there any limitations to using the feature (hardware support, resource usage)?**
nope, some will make a few more dns queries happen, some will make less
**Are there any adverse or non-obvious interactions with other features? Should the feature be mutually exclusive?**
none are mutually exclusive
**Any relevant documentation or references about the feature.**
https://doc.powerdns.com/recursor/settings.html#refresh-on-ttl-perc
https://doc.powerdns.com/recursor/settings.html#nothing-below-nxdomain
https://doc.powerdns.com/recursor/settings.html#minimum-ttl-override