Summary
When configuring PDNS (Protective DNS,) it is important to understand the difference between forward-zones and forward-zones-recurse. In general, it is safer to use the forward-zones-recurse if you are unsure of the status of the upstream server you want to configure. You can find detailed documentation from PowerDNS on the settings for both forward-zones as well as forward-zones-recurse.
Choosing which type of Forward Zone to configure
When using a non-managed upstream server in your Forward-zones, it is best to configure it as a forward-zones-recurse. Since something could change on the infrastructure of their name servers and may break the lookup on your usage of those sites. When in doubt, use the forward-zones-recurse in the PDNS Configuration.
Configuring pdns-recursor use an upstream DNS server
In an escalated SSH session, edit the file /etc/pdns-recursor/recursor.conf
Add the forwarded recursive zone or zones, replacing the example address appropriately.
forward-zones-recurse=.=1.2.3.4
The above example would forward all requests to the upstream address of 1.2.3.4
the "." is a wildcard for all zones.
Common Errors
If you have an entry in the Forward-zones that is not an authoritative server you will experience "SERVFAIL" errors when using dig for the related domains along with seeing errors in browser when accessing the URL similar to "Error: DNS Lookup Errors".
BEST PRACTICE: Do not use forward-zones, always use forward-zones-recurse.