v1.17.5 · MIT licensed · Production ready
A fast, safe DNS server. Written in Rust.
Recursive resolver, authoritative server, DNS-over-TLS, DNSSEC validation, and RPZ filtering — in a single static binary.
What's inside
Everything a modern DNS server needs.
Recursive resolver
Full iterative resolution from root hints, with CNAME chain following and qname minimization.
Authoritative server
Serve zones from RFC 1035 zone files, or PostgreSQL with LISTEN/NOTIFY hot reload.
DNS-over-TLS
RFC 7858 encrypted DNS on port 853, via rustls. No OpenSSL dependency.
DNSSEC validation
Chain of trust verification from root trust anchors. Validated by default.
RPZ filtering
Block or redirect domains via Response Policy Zones. Ad blocking, malware filtering, parental controls.
Prometheus metrics
Per-listener QPS, cache hit rate, latency histograms — all exposed at /metrics.
Performance
On par with multi-threaded Unbound. In Rust.
rDNS handles ~640K cached queries per second on commodity hardware — matching a fully multi-threaded Unbound, and ahead at low concurrency. The optimization journey from a naïve 29K-QPS baseline is documented step by step.
QPS, 50 cached clients, both on all cores
Safety
Memory-safe by construction.
Written in Rust. No buffer overflows, no use-after-free, no double-frees — entire classes of CVEs eliminated at compile time. Privilege dropping after bind. FreeBSD Capsicum capability sandbox.
rustls for TLS — no OpenSSL exposure.
[security]
sandbox = true
rate_limit = 1000
[server]
user = "rdns"
group = "rdns"Get rDNS running in 60 seconds.
Single static binary. TOML config. MIT licensed. Linux, FreeBSD, and macOS.