semihalev / Sdns

🚀 Privacy important, fast, recursive dns resolver server with dnssec support

Installation

go get github.com/semihalev/sdns

Pre-build Binaries

Download the latest release from Github Repo

Docker Image

1. Docker Package (update every release)
2. Docker Hub (alternative)

$ docker run -d --name sdns -p 53:53 -p 53:53/udp sdns

Homebrew for macOS

$ brew install sdns
$ brew install semihalev/tap/sdns (update every release)

Run as service

$ brew services start sdns

Snapcraft

$ snap install sdns

AUR for ArchLinux

$ yay -S sdns-git

Tip: Pre-build binaries, docker package, brew tap and snap automatically create by Github workflows

Building

$ go build

Testing

$ make test

Flags

Debug Environment

$ export SDNS_DEBUGNS=true && export SDNS_PPROF=true && ./sdns

SDNS_DEBUGNS enviroment useful when you want to check authoritive servers RTT times. Usage: send HINFO query for zones with chaos class.

Example Output:

$ dig chaos hinfo example.com

; <<>> DiG 9.17.1 <<>> chaos hinfo example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29636
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: f27dbb995df5ac79e4fa37c07d131b5bd03aa1c5f802047a7c02fb228a886cb281ecc319323dea81 (good)
;; QUESTION SECTION:
;example.com.			CH	HINFO

;; AUTHORITY SECTION:
example.com.		0	CH	HINFO	"Host" "IPv4:199.43.135.53:53 rtt:142ms health:[GOOD]"
example.com.		0	CH	HINFO	"Host" "IPv4:199.43.133.53:53 rtt:145ms health:[GOOD]"
example.com.		0	CH	HINFO	"Host" "IPv6:[2001:500:8f::53]:53 rtt:147ms health:[GOOD]"
example.com.		0	CH	HINFO	"Host" "IPv6:[2001:500:8d::53]:53 rtt:148ms health:[GOOD]"

Configuration (v1.1.0)

Plugins Configuration

You can add your own plugins to sdns. The plugin order is very important. The orders of plugins and middlewares will effect each other. Config keys should be string and values can be anything. The plugins will load before cache middleware with their orders.

Plugin interface is very simple. For more information, you can look the example plugin

Example Config

[plugins]
     [plugins.example]
     path = "/myplugindir/exampleplugin.so"
     config = {key_1 = "value_1",intkey = 2,boolkey = true,keyN = "nnn"}
     [plugins.another]
     path = "/myplugindir/anotherplugin.so"

Server Configuration Checklist

• Increase file descriptor on your server

Features

• Linux/BSD/Darwin/Windows supported
• DNS RFC compatibility
• DNS lookups within listed ipv4 and ipv6 auth servers
• DNS caching
• DNSSEC validation
• DNS over TLS support (DoT)
• DNS over HTTPS support (DoH)
• Outbound IP selection
• Middleware Support, you can add, your own middleware
• RTT priority within listed servers
• Failover forwarders while returning failured responses
• EDNS Cookie Support (client<->server)
• EDNS NSID Support
• Full IPv6 support (client<->server, server<->server)
• Query based ratelimit
• IP based ratelimit
• Access list
• Access log
• Prometheus basic query metrics
• Black-hole for malware responses
• HTTP API support
• Cache Purge API and query support
• Answer chaos txt queries for version.bind and hostname.bind
• Empty zones support described at RFC 1918
• External plugins supported

TODO

• [x] More tests
• [x] Try lookup NS address better way
• [x] DNS over TLS support
• [x] DNS over HTTPS support
• [x] Full DNSSEC support
• [x] RTT optimization
• [x] Access list
• [x] Periodic priming queries described at RFC 8109
• [x] Full IPv6 support (server<->server communication)
• [x] Query name minimization to improve privacy described at RFC 7816
• [x] DNAME Redirection in the DNS described at RFC 6672
• [ ] Automated Updates DNSSEC Trust Anchors described at RFC 5011
• [ ] DNS64 DNS Extensions for NAT from IPv6 Clients to IPv4 Servers described at RFC 6147

Performance

These benchmarks were run on a server with Intel Xeon E5-2609 v4 cpu and 32GB memory on localhost. DNS-OARC dnsperf (https://www.dns-oarc.net/tools/dnsperf) tool used with 50.000 sample query data.

Who Used

CubeDNS public open resolver project using sdns on multi location. The project supported both UDP and TCP also DoT and DoH.

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

Please make sure to update tests as appropriate.

♥️ Made With

• miekg/dns - Alternative (more granular) approach to a DNS library

Inspired by

• coredns/coredns
• looterz/grimd

License

MIT