NLnetLabs/unbound
Unbound
Unbound est un résolveur DNS qui fonctionne comme un serveur de mise en cache, récursif et de validation. Il traduit les noms de domaine en adresses IP en effectuant des recherches indépendantes sur Internet ou en transmettant les requêtes à des résolveurs externes.
Le projet se distingue comme un serveur DNS programmable, offrant une interface de script Python et le chargement dynamique de bibliothèques partagées pour personnaliser le pipeline de résolution. Il sert également de passerelle DNS64 NAT64, synthétisant des adresses IPv6 à partir d'enregistrements IPv4 pour permettre la communication aux clients IPv6 uniquement.
Le système inclut des frameworks de sécurité pour la validation cryptographique DNSSEC et le chiffrement du trafic DNS pour empêcher l'empoisonnement du cache et l'écoute clandestine. Ses capacités s'étendent au filtrage des réponses basé sur des politiques, à la mise en cache multi-niveaux avec des backends de base de données externes, et à la livraison de données de zone d'autorité locale.
Le contrôle administratif est géré via une interface distante sécurisée pour envoyer des commandes chiffrées au serveur en cours d'exécution.
Features
- Recursive DNS Resolution - Functions as a recursive DNS resolver that independently navigates the DNS hierarchy to resolve domain names.
- Recursive DNS Resolvers - Functions as a recursive DNS resolver that independently traverses the DNS hierarchy to resolve domain names.
- DNS Response Caching - Provides multi-level response caching using local memory and external database backends to reduce latency.
- DNS Caches - Stores resolved domain records locally to reduce network latency and minimize upstream requests.
- DNS64 Translation - Synthesizes IPv6 addresses from IPv4 records to enable IPv6-only clients to communicate with IPv4 servers.
- DNS Forwarding Routing - Forwards queries for specified zones to other recursive servers instead of performing independent recursion.
- IPv6 Record Generation - Creates synthetic IPv6 AAAA records from A records using a specified prefix via DNS64.
- DNS Servers - Operates as a DNS server that resolves domain names to IP addresses and manages network traffic.
- DNS64 Translation - Implements DNS64 synthesis to generate synthetic IPv6 AAAA records from IPv4 A records.
- DNSSEC Chain-of-Trust Validators - Provides a validating resolver that cryptographically verifies DNSSEC chains of trust from root anchors.
- DNSSEC Signature Validation - Cryptographically verifies digital signatures on incoming DNS responses to ensure authenticity and prevent cache poisoning.
- Programmable Pipelines - Offers a programmable DNS server with a Python scripting interface and dynamic shared-library loading to customize resolution.
- Cache Backends - Supports external database backends to maintain a persistent second-level DNS cache.
- DNS Resolution Scripting - Runs custom Python scripts within the resolution pipeline to dynamically modify queries and answers.
- Resolution Pipeline Scripting - Offers a Python scripting interface to customize and modify incoming queries and outgoing answers dynamically.
- NAT64 Gateways - Acts as a NAT64 gateway, routing traffic from IPv6-only clients to IPv4-only servers using a specific prefix.
- DNS Query Filters - Applies policy zones to block responses or trigger actions based on query names or client IPs.
- Local Zone Views - Defines custom local zones to deliver tailored DNS responses to different groups of clients.
- EDNS Client Subnet Routing - Implements EDNS Client Subnet (ECS) routing to forward client address information for optimized location-aware responses.
- Encrypted DNS Servers - Provides an encrypted DNS server supporting secure communication protocols to prevent eavesdropping.
- Stub Zone Routing - Directs queries for specific domains to authoritative nameservers to access private or local data.
- Dynamic Library Loading - Supports loading external shared libraries at runtime to extend core functionality without recompilation.
- DNS Response Filtering - Implements policy-based response filtering to trigger specific routing or denial actions based on query names or client IPs.
- DNS Servers - Fast, secure, and recursive DNS resolver.
- DNS Servers - Validating, recursive, and caching DNS resolver.
