hickory-dns/hickory-dns
Hickory Dns
Hickory-DNS is a DNS implementation written in Rust that provides a full suite of DNS capabilities: a client library for querying and constructing DNS messages, a recursive resolver with caching, an authoritative DNS server, and support for DNSSEC validation and signing. It can operate as a DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) client, and includes a multicast DNS (mDNS) implementation for local network discovery without a central server.
The project differentiates itself through its integrated DNSSEC pipeline, which validates signatures by chaining from a root trust anchor and can automatically re-sign zones on dynamic updates. Its recursive resolver traverses the DNS hierarchy from root servers, caching intermediate and negative responses, while the authoritative server supports incremental zone transfers (IXFR), notify, and dynamic updates authenticated with SIG(0). All DNS transports—UDP, TCP, TLS, HTTPS, and mDNS—are abstracted behind a unified interface.
The library also manages DNS resource records, serializes and deserializes messages in both binary wire format and human-readable text, and handles queries, updates, and response processing with timeouts. Command-line resolution and support for EDNS, IPv6, and various record types round out the capability surface.
Features
- Authoritative DNS Hosting - Serves as an authoritative DNS server with zone transfers, notify, and dynamic updates.
- Authoritative Zone Hosting - Ships a full authoritative DNS server with zone transfer, notify, and service discovery support.
- Incremental Zone Transfers - Serves authoritative DNS zones with support for incremental zone transfer and DNSSEC signing.
- DNS Message Codecs - The DNS library serializes and deserializes DNS resource records and messages in binary wire format and human-readable text for network transmission and storage.
- DNS Query Clients - Transmits DNS query or update messages to a server and processes responses with timeout handling.
- Encrypted Query Clients - Operates as a client for DNS-over-TLS and DNS-over-HTTPS encrypted queries.
- DNS Resolution - Resolves DNS queries for various record types using system-configured or custom resolvers with EDNS and IPv6 support.
- DNS-over-TLS Clients - Provides both DNS-over-TLS and DNS-over-HTTPS client capabilities for encrypted name resolution.
- Caching Resolvers - Traverses the DNS hierarchy from root to authoritative servers, caching intermediate results and negative responses.
- Recursive DNS Resolution - Resolves domain names recursively by traversing the DNS hierarchy from root servers to authoritative servers.
- DNSSEC Zone Signing - Manages DNSSEC data structures and utilities for securing DNS responses and zone transfers.
- DNSSEC Signature Validation - Validates DNSSEC signatures by chaining from the root trust anchor for response authenticity.
- Recursive DNS Resolvers - Implements a full recursive resolver that caches intermediate and negative responses.
- DNS Record Resolvers - Queries DNS record types asynchronously over TCP and returns the deserialized data.
- SIG(0)-Authenticated Updates - Implements dynamic DNS updates authenticated with SIG(0) signed requests for record modification.
- Multicast DNS Resolution - Implements multicast DNS for local network hostname discovery without a central server.
- Automatic Re-signing - Automatically re-signs DNS zones on dynamic updates using NSEC and NSEC3 chain-of-trust validation.
- DNSSEC Chain-of-Trust Validators - Validates DNSSEC signatures by chaining from the root trust anchor for response authenticity.
- Encrypted DNS Resolvers - Tunnels DNS requests over TLS or HTTPS to protect against eavesdropping and tampering.
