You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Spike ebaa84da10
Publish to Arch User Repository (#52)
3 days ago
.github Bump codecov/codecov-action from v1.0.13 to v1.0.14 (#50) 4 days ago
api security and linter errcheck updates 3 months ago
authcache fix spaces 3 months ago
cache security and linter errcheck updates 3 months ago
config fix config file generation 3 months ago
contrib/linux fix linux scripts 3 months ago
dnsutil Added cancel with rcode and rename func name (#42) 2 months ago
middleware Added cancel with rcode and rename func name (#42) 2 months ago
mock cosmetic changes 3 months ago
response Added CoreDNS copyright notices 4 months ago
server fix incorrect conversion 4 days ago
snap fix config file generation 3 months ago
waitgroup added waitgroup comments 4 months ago
.codecov.yml add codecov yaml 2 years ago
.gitignore gitignore update 5 months ago
.goreleaser.yml delete custom block 2 months ago
CNAME Create CNAME 4 months ago
Dockerfile Update docker and go mod tidy 2 months ago
LICENSE small changes 2 years ago
Makefile goreleaser update 3 months ago Publish to Arch User Repository (#52) 3 days ago
_config.yml Update _config.yml 4 months ago
benchmarks.png benchmarks added 4 months ago
doc.go makefile update 3 months ago
gen.go as112 middleware added. please see for details. 4 months ago
generated.go as112 middleware added. please see for details. 4 months ago
go.mod Bump from 1.1.33 to 1.1.34 (#51) 4 days ago
go.sum Bump from 1.1.33 to 1.1.34 (#51) 4 days ago
logo.png logo file 2 years ago
sdns.go release version 1.1.6 2 months ago
sdns_test.go security and linter errcheck updates 3 months ago

Go Go Report Card GoDoc codecov GitHub version

🚀 Privacy important, fast, recursive dns resolver server with dnssec support


go get

Pre-build Binaries

Download the latest release from Github Repo

Docker Image

  1. Docker Package (update every release)
  2. Docker Hub (alternative)
$ docker run -d --name sdns -p 53:53 -p 53:53/udp sdns

Homebrew for macOS

$ brew install sdns
$ brew install semihalev/tap/sdns (update every release)

Run as service

$ brew services start sdns


$ snap install sdns

AUR for ArchLinux

$ yay -S sdns-git

Tip: Pre-build binaries, docker package, brew tap and snap automatically create by Github workflows


$ go build


$ make test


Flag Desc
config Location of the config file, if config file not found, a config will generate
v Show version information

Debug Environment

$ export SDNS_DEBUGNS=true && export SDNS_PPROF=true && ./sdns

SDNS_DEBUGNS enviroment useful when you want to check authoritive servers RTT times. Usage: send HINFO query for zones with chaos class.

Example Output:

$ dig chaos hinfo

; <<>> DiG 9.17.1 <<>> chaos hinfo
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29636
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1

; EDNS: version: 0, flags:; udp: 1232
; COOKIE: f27dbb995df5ac79e4fa37c07d131b5bd03aa1c5f802047a7c02fb228a886cb281ecc319323dea81 (good)

;; AUTHORITY SECTION:		0	CH	HINFO	"Host" "IPv4: rtt:142ms health:[GOOD]"		0	CH	HINFO	"Host" "IPv4: rtt:145ms health:[GOOD]"		0	CH	HINFO	"Host" "IPv6:[2001:500:8f::53]:53 rtt:147ms health:[GOOD]"		0	CH	HINFO	"Host" "IPv6:[2001:500:8d::53]:53 rtt:148ms health:[GOOD]"

Configuration (v1.1.0)

Key Desc
version Config version
blocklists List of remote blocklists address list. All lists will be download to blocklist folder.
blocklistdir List of locations to recursively read blocklists from (warning, every file found is assumed to be a hosts-file or domain list)
loglevel What kind of information should be logged, Log verbosity level crit,error,warn,info,debug
accesslog The location of access log file, left blank for disabled. SDNS uses Common Log Format by default.
bind Address to bind to for the DNS server. Default :53
bindtls Address to bind to for the DNS-over-TLS server. Default :853
binddoh Address to bind to for the DNS-over-HTTPS server. Default :8053
tlscertificate TLS certificate file path
tlsprivatekey TLS private key file path
outboundips Outbound ipv4 addresses, if you set multiple, sdns can use random outbound ipv4 address by request based
outboundip6s Outbound ipv6 addresses, if you set multiple, sdns can use random outbound ipv6 address by request based
rootservers DNS Root IPv4 servers
root6servers DNS Root IPv6 servers
rootkeys Trusted anchors for DNSSEC
fallbackservers Failover resolver ipv4 or ipv6 addresses with port, left blank for disabled: Example: ""
api Address to bind to for the http API server, left blank for disabled
nullroute IPv4 address to forward blocked queries to
nullroutev6 IPv6 address to forward blocked queries to
accesslist Which clients allowed to make queries
timeout Network timeout for each dns lookups in duration Default: 2s
hostsfile Enables serving zone data from a hosts file, left blank for disabled
expire Default error cache TTL for in seconds Default: 600
cachesize Cache size (total records in cache) Default: 256000
maxdepth Maximum iteration depth for a query Default: 30
ratelimit Query based ratelimit per second, 0 for disabled. Default: 0
clientratelimit Client ip address based ratelimit per minute, 0 for disable. if client support edns cookie no limit. Default: 0
blocklist Manual blocklist entries
whitelist Manual whitelist entries
cookiesecret DNS cookie secret (RFC 7873), if no cookiesecret set, it will be generate automatically
nsid DNS server identifier (RFC 5001), it's useful while operating multiple sdns. left blank for disabled
chaos Enable to answer version.server, version.bind, hostname.bind and id.server chaos txt queries.
qname_min_level Qname minimize level.If higher, it can be more complex and impact the response performance. If set 0, qname min will be disable
emptyzones Empty zones return answer for RFC 1918 zones. Please see for details.

Plugins Configuration

You can add your own plugins to sdns. The plugin order is very important. The orders of plugins and middlewares will effect each other. Config keys should be string and values can be anything. The plugins will load before cache middleware with their orders.

Plugin interface is very simple. For more information, you can look the example plugin

Example Config

     path = "/myplugindir/"
     config = {key_1 = "value_1",intkey = 2,boolkey = true,keyN = "nnn"}
     path = "/myplugindir/"

Server Configuration Checklist

  • Increase file descriptor on your server


  • Linux/BSD/Darwin/Windows supported
  • DNS RFC compatibility
  • DNS lookups within listed ipv4 and ipv6 auth servers
  • DNS caching
  • DNSSEC validation
  • DNS over TLS support (DoT)
  • DNS over HTTPS support (DoH)
  • Outbound IP selection
  • Middleware Support, you can add, your own middleware
  • RTT priority within listed servers
  • Failover forwarders while returning failured responses
  • EDNS Cookie Support (client<->server)
  • EDNS NSID Support
  • Full IPv6 support (client<->server, server<->server)
  • Query based ratelimit
  • IP based ratelimit
  • Access list
  • Access log
  • Prometheus basic query metrics
  • Black-hole for malware responses
  • HTTP API support
  • Cache Purge API and query support
  • Answer chaos txt queries for version.bind and hostname.bind
  • Empty zones support described at RFC 1918
  • External plugins supported



These benchmarks were run on a server with Intel Xeon E5-2609 v4 cpu and 32GB memory on localhost. DNS-OARC dnsperf ( tool used with 50.000 sample query data.

SDNS %99,88 %73,60 %1,36 %25,04 101s480ms 492/s
PowerDNS %99,59 %72,76 %1,40 %25,84 123s930ms 402/s
Bind %99,40 %72,98 %1,09 %25,94 115s150ms 431/s
Unbound %99,14 %73,19 %0,90 %25,90 178s80ms 278/s

Who Used

CubeDNS public open resolver project using sdns on multi location. The project supported both UDP and TCP also DoT and DoH.

Proto Servers
IPv6 2a0a:be80::cbe:4444, 2a0a:be80::cbe:4445


Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

Please make sure to update tests as appropriate.

♥️ Made With

  • miekg/dns - Alternative (more granular) approach to a DNS library

Inspired by