NLnetLabs/unbound
Unbound
Unbound هو محلل DNS يعمل كخادم تخزين مؤقت، وعودي، ومتحقق. يقوم بترجمة أسماء النطاقات إلى عناوين IP عن طريق إجراء عمليات بحث مستقلة عبر الإنترنت أو عن طريق إعادة توجيه الاستعلامات إلى محللات خارجية.
يتميز المشروع كخادم DNS قابل للبرمجة، ويوفر واجهة برمجة نصية بلغة Python وتحميل مكتبة مشتركة ديناميكية لتخصيص مسار التحليل. كما يعمل كبوابة DNS64 NAT64، حيث يقوم بتوليف عناوين IPv6 من سجلات IPv4 لتمكين الاتصال لعملاء IPv6 فقط.
يتضمن النظام أطر عمل أمنية للتحقق من تشفير DNSSEC وتشفير حركة مرور DNS لمنع تسمم التخزين المؤقت والتنصت. تمتد قدراته إلى تصفية الاستجابة القائمة على السياسة، والتخزين المؤقت متعدد المستويات مع خلفيات قاعدة بيانات خارجية، وتسليم بيانات منطقة السلطة المحلية.
تتم إدارة التحكم الإداري من خلال واجهة بعيدة آمنة لإرسال أوامر مشفرة إلى الخادم قيد التشغيل.
Features
- Recursive DNS Resolution - Functions as a recursive DNS resolver that independently navigates the DNS hierarchy to resolve domain names.
- Recursive DNS Resolvers - Functions as a recursive DNS resolver that independently traverses the DNS hierarchy to resolve domain names.
- DNS Response Caching - Provides multi-level response caching using local memory and external database backends to reduce latency.
- DNS Caches - Stores resolved domain records locally to reduce network latency and minimize upstream requests.
- DNS64 Translation - Synthesizes IPv6 addresses from IPv4 records to enable IPv6-only clients to communicate with IPv4 servers.
- DNS Forwarding Routing - Forwards queries for specified zones to other recursive servers instead of performing independent recursion.
- IPv6 Record Generation - Creates synthetic IPv6 AAAA records from A records using a specified prefix via DNS64.
- DNS Servers - Operates as a DNS server that resolves domain names to IP addresses and manages network traffic.
- DNS64 Translation - Implements DNS64 synthesis to generate synthetic IPv6 AAAA records from IPv4 A records.
- DNSSEC Chain-of-Trust Validators - Provides a validating resolver that cryptographically verifies DNSSEC chains of trust from root anchors.
- DNSSEC Signature Validation - Cryptographically verifies digital signatures on incoming DNS responses to ensure authenticity and prevent cache poisoning.
- Programmable Pipelines - Offers a programmable DNS server with a Python scripting interface and dynamic shared-library loading to customize resolution.
- Cache Backends - Supports external database backends to maintain a persistent second-level DNS cache.
- DNS Resolution Scripting - Runs custom Python scripts within the resolution pipeline to dynamically modify queries and answers.
- Resolution Pipeline Scripting - Offers a Python scripting interface to customize and modify incoming queries and outgoing answers dynamically.
- NAT64 Gateways - Acts as a NAT64 gateway, routing traffic from IPv6-only clients to IPv4-only servers using a specific prefix.
- DNS Query Filters - Applies policy zones to block responses or trigger actions based on query names or client IPs.
- Local Zone Views - Defines custom local zones to deliver tailored DNS responses to different groups of clients.
- EDNS Client Subnet Routing - Implements EDNS Client Subnet (ECS) routing to forward client address information for optimized location-aware responses.
- Encrypted DNS Servers - Provides an encrypted DNS server supporting secure communication protocols to prevent eavesdropping.
- Stub Zone Routing - Directs queries for specific domains to authoritative nameservers to access private or local data.
- Dynamic Library Loading - Supports loading external shared libraries at runtime to extend core functionality without recompilation.
- DNS Response Filtering - Implements policy-based response filtering to trigger specific routing or denial actions based on query names or client IPs.
- DNS Servers - Fast, secure, and recursive DNS resolver.
- DNS Servers - Validating, recursive, and caching DNS resolver.
