Open-source alternatives to Unbound

Hickory-DNS is a DNS implementation written in Rust that provides a full suite of DNS capabilities: a client library for querying and constructing DNS messages, a recursive resolver with caching, an authoritative DNS server, and support for DNSSEC validation and signing. It can operate as a DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) client, and includes a multicast DNS (mDNS) implementation for local network discovery without a central server. The project differentiates itself through its integrated DNSSEC pipeline, which validates signatures by chaining from a root trust anchor and can auto

SmartDNS is a local recursive DNS resolver and server that manages granular query rules, dual-stack networking, and encrypted gateway proxying. It functions as a DNS traffic filter and DNS64 translator, allowing IPv6-only clients to communicate with IPv4 servers. The project distinguishes itself through parallel upstream querying, which sends requests to multiple servers simultaneously to return the response with the lowest network latency. It supports DNS server virtualization, enabling the operation of multiple independent server instances on different ports, each with its own configuration

Blocky is a stateless DNS proxy that functions as a network-wide ad-blocker and content filter. It operates as a single binary or Docker container with no database or persistent state, accepting DNS queries over UDP, TCP, HTTPS, TLS, QUIC, and HTTP/3 through a unified plugin-based query pipeline. The core of the system is a client-group policy engine that assigns devices to named groups and applies per-group blocklists, allowlists, and upstream resolvers, with all configuration changes applied through hot-reloading without requiring a restart. The project distinguishes itself through its modu

dnsguide is a software implementation of the DNS protocol designed to handle queries and responses between clients and nameservers. It functions as a recursive DNS server and network service tool for managing the resolution of domain names within local or wide area networks. The project provides a framework for building a custom DNS server, incorporating recursive resolution logic and stub resolver integration to translate hostnames into IP addresses. It is designed for implementing the DNS protocol from scratch to facilitate network protocol learning and custom name resolution. The implemen

Tenta DNS is a recursive and authoritative domain name server implementation written in Go. It provides secure network resolution services by translating human-readable domain names into machine addresses while enforcing cryptographic standards to ensure data privacy and authenticity. The software distinguishes itself through a focus on secure transport and integrity verification. It utilizes encrypted tunnels for upstream communication to prevent eavesdropping and incorporates a validation engine to verify digital signatures on resource records. To manage global traffic, the system supports

This project is a Go DNS library used for implementing DNS clients and servers. It provides a toolkit for packet exchange, record parsing, and the development of custom nameservers. The library includes a DNS server framework and a zone manager for parsing standard zone files and synchronizing data via zone transfers. It features a dedicated DNSSEC implementation library for generating cryptographic keys and validating signatures, as well as a TLS transport for encrypted connections between clients and servers. The system covers a broad range of capabilities including DNS resolver functional

DNSControl is an infrastructure-as-code tool designed to manage DNS records and zones across multiple providers through a unified, programmable configuration language. By treating DNS as code, it enables teams to maintain consistent infrastructure state, automate record updates, and perform version-controlled management of network settings across diverse cloud, registrar, and network DNS services. The system functions as a multi-provider orchestrator that uses a declarative reconciliation engine to compare local configurations against live remote states. It employs a provider-agnostic abstrac

doggo is a multi-protocol DNS lookup client, performance analyzer, and diagnostic troubleshooting tool. It functions as a command-line utility for performing DNS queries across various transport protocols, including UDP, TCP, HTTPS, TLS, and QUIC. The project distinguishes itself through a focus on secure and distributed resolution. It implements encrypted DNS standards such as DNS over HTTPS, DNS over QUIC, and DNSCrypt, and provides DNSSEC validation to verify chains of trust for signed domains. Additionally, it can execute queries from global geographic locations via an external API to ana

This project provides a containerized DNS sinkhole and network-wide traffic filtering solution. It functions as a central network resolver that intercepts domain queries, allowing users to block advertisements, trackers, and malicious domains by returning null responses to connected devices. The platform distinguishes itself through its integrated DHCP server and comprehensive management capabilities, which allow for automated IP address allocation and granular control over network traffic. It supports complex filtering through regular expression matching, hierarchical rule prioritization, an

3proxy is a multi-protocol proxy server and network access control gateway. It functions as a network traffic forwarder capable of routing TCP and UDP traffic across HTTP, SOCKS, and various email and file protocols. The project provides specialized capabilities for secure traffic inspection, including the decryption and analysis of HTTPS and TLS streams through certificate spoofing and mutual authentication. It further supports client identity anonymization by routing outbound traffic through recursive upstream proxy chains. The software covers a broad range of network management functions,

Glider is a multi-protocol forward proxy, transparent proxy gateway, and network service provider. It functions as a DNS and DHCP server, a Linux IP set manager, and a network traffic load balancer. The project distinguishes itself through a protocol-translation bridge that translates traffic between different proxy schemes and a chain-based routing system that sequences multiple remote proxy servers. It supports transparent traffic interception at the system level and utilizes build-time protocol stripping to minimize the binary size of the executable. The system covers a broad range of net

NextDNS is a network DNS client and proxy that functions as a local resolver, forwarder, and DNS-over-HTTPS proxy. Its primary purpose is to route local name resolution requests to external providers using encrypted HTTPS traffic to improve privacy and bypass network restrictions. The service distinguishes itself by embedding client identity metadata—collected via mDNS or DHCP—into outgoing queries, allowing for per-device tracking and the application of unique filtering profiles. It features advanced routing logic, including split-horizon DNS for balancing public and private resolution, doma

Wirehole is a containerized network stack that integrates a WireGuard VPN server with recursive DNS resolution and sinkhole-based advertisement filtering. It bundles these interdependent services into a single managed environment using a compose-based deployment. The system enables network-wide ad blocking and tracker filtering by intercepting DNS queries via a sinkhole. It implements recursive DNS resolution to resolve domain names independently of external upstream providers and provides a web-based interface for managing VPN client peers and keys. Additional capabilities include split-tun

CoreDNS is a modular domain name system server designed for cloud-native environments. It functions as a flexible DNS resolver and forwarder that manages network traffic by routing queries based on zone-based rules and authoritative data. The server is built to integrate with service discovery systems, enabling it to map service names to network addresses within containerized infrastructure. The project is defined by a plugin-based request pipeline that allows for the extension of server functionality through custom modules. These plugins can intercept, modify, or log network requests in real

Webmin is a web-based administration interface for Unix systems. It provides a centralized console for managing the full range of server administration tasks — users and groups, software packages, storage, network configuration, system services, and security — all through a browser. Its modular architecture allows separate modules to handle databases (MySQL, MariaDB, PostgreSQL), web servers (Apache), DNS (BIND), email (Sendmail, Dovecot), file sharing (Samba, NFS), and more, with a unified access control system that restricts what each administrator can see and do. What sets Webmin apart is

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

VictoriaMetrics is a high-performance, scalable time series database and observability platform designed for long-term storage and analysis of metric, log, and trace data. It functions as a unified backend for monitoring ecosystems, offering full compatibility with industry-standard protocols and query languages. The system is built to handle massive data volumes through a distributed architecture that supports horizontal scaling and efficient data lifecycle management. The platform distinguishes itself through a storage engine that utilizes consistent hashing for data sharding and log-struct

mosdns is a DNS forwarding server and traffic filter that routes DNS queries to multiple upstream providers. It functions as a rule-based DNS router and a proxy for DNS-over-HTTPS and DNS-over-TLS to ensure secure DNS resolution. The system utilizes a pipeline-based request processing model and rule-based query routing to direct specific domain queries to different upstream servers. It implements pluggable transport layers and forwarding protocols, including HTTPS, TLS, and QUIC, to encrypt traffic and prevent eavesdropping. The project includes capabilities for upstream load balancing to di

AdGuardHome is a network-wide software solution that provides centralized control over domain name resolution, content filtering, and local network management. It functions as a recursive DNS server and DHCP address server, intercepting network traffic to enforce security policies and block unwanted content across all connected devices. By acting as a central gateway, it ensures that every device on a home or office network benefits from consistent protection and private, authenticated name resolution. The software distinguishes itself through granular client management and robust security fe

Mail-in-a-Box is a self-hosted email server appliance that automates the deployment of SMTP, IMAP, and POP3 services on Linux. It functions as a complete suite including a DNS management server, a spam and abuse filter, and a web-based administrative control panel for managing users, aliases, and storage quotas. The project distinguishes itself through a high degree of automation for email security and authenticity. It automatically provisions and maintains SPF, DKIM, DMARC, and DNSSEC records to prevent domain spoofing, while managing the installation and rotation of TLS certificates and enf

Devilbox is a containerized development environment that provides a reproducible suite of web servers, databases, and language runtimes managed through a unified configuration. It functions as a Docker-based local development stack for LAMP and MEAN software stacks and as a manager for switching between different versions of these services to match specific project requirements. The system distinguishes itself by automating local network orchestration. It includes a Docker-based virtual host manager that automatically maps local directories to custom domains and a local DNS and SSL orchestrat

dnscrypt-proxy is an anonymizing DNS proxy and encrypted DNS resolver. It acts as a local DNS forwarder that secures internet lookups by wrapping standard DNS queries in encrypted tunnels using the DNSCrypt and DNS-over-HTTPS protocols to prevent eavesdropping and tampering. The project provides network privacy protection by routing DNS requests through anonymized relays to obfuscate the client's original IP address. It further distinguishes itself through traffic management capabilities, such as mapping specific domains to designated resolvers and distributing queries across multiple servers

BPB-Worker-Panel is a control panel designed for deploying and managing VLESS and Trojan proxies hosted on Cloudflare Workers. It functions as a proxy subscription generator and a manager for secure DNS over HTTPS servers and WireGuard configuration provisioning. The project distinguishes itself through network traffic obfuscation capabilities, utilizing packet fragmentation and SNI spoofing to evade detection. It provides specialized administration for Cloudflare Warp and Warp Pro connections, including the ability to optimize endpoints and export WireGuard configurations. The system covers

This project is a curated collection of deployment files and configurations for hosting a wide variety of open-source services on a home server. It primarily utilizes Docker and Docker Compose to automate the orchestration, lifecycle management, and deployment of containerized applications. The repository provides a comprehensive suite for self-hosted infrastructure, covering network management tools, media streaming, and home automation. It includes specialized configurations for securing internal services via reverse proxies, WireGuard VPN tunnels, and automated SSL/TLS certificate manageme

DietPi is an ultra-lightweight Debian distribution and software platform purpose-built for single-board computers. It provides a minimal operating system that strips away unnecessary services to reduce CPU and RAM usage, and includes a curated software catalogue of pre-optimised applications that can be installed with a single command. The system reads a plain-text configuration file before first boot to perform unattended OS and software installation, and offers a web interface for remote system administration. What distinguishes DietPi is its comprehensive, integrated approach to turning a

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

pywin32 is a collection of Python extensions that serve as a wrapper for the native Windows API, enabling the invocation of operating system functions to manage low-level system resources and hardware. It provides a core library for interacting with Component Object Model objects to automate native desktop applications, a framework for constructing native Windows GUI applications, and an interface for registering and running Python scripts as background system services. The project distinguishes itself by providing deep integration with the Windows environment, including the ability to bind P