NLnetLabs/unbound
Unbound
Unbound is a DNS resolver that functions as a caching, recursive, and validating server. It translates domain names into IP addresses by performing independent lookups across the internet or by forwarding queries to external resolvers.
The project distinguishes itself as a programmable DNS server, offering a Python scripting interface and dynamic shared-library loading to customize the resolution pipeline. It also serves as a DNS64 NAT64 gateway, synthesizing IPv6 addresses from IPv4 records to enable communication for IPv6-only clients.
The system includes security frameworks for DNSSEC cryptographic validation and DNS traffic encryption to prevent cache poisoning and eavesdropping. Its capabilities extend to policy-based response filtering, multi-level caching with external database backends, and the delivery of local authority zone data.
Administrative control is managed through a secure remote interface for sending encrypted commands to the running server.
Features
- Recursive DNS Resolution - Functions as a recursive DNS resolver that independently navigates the DNS hierarchy to resolve domain names.
- Recursive DNS Resolvers - Functions as a recursive DNS resolver that independently traverses the DNS hierarchy to resolve domain names.
- DNS Response Caching - Provides multi-level response caching using local memory and external database backends to reduce latency.
- DNS Caches - Stores resolved domain records locally to reduce network latency and minimize upstream requests.
- DNS64 Translation - Synthesizes IPv6 addresses from IPv4 records to enable IPv6-only clients to communicate with IPv4 servers.
- DNS Forwarding Routing - Forwards queries for specified zones to other recursive servers instead of performing independent recursion.
- IPv6 Record Generation - Creates synthetic IPv6 AAAA records from A records using a specified prefix via DNS64.
- DNS Servers - Operates as a DNS server that resolves domain names to IP addresses and manages network traffic.
- DNS64 Translation - Implements DNS64 synthesis to generate synthetic IPv6 AAAA records from IPv4 A records.
- DNSSEC Chain-of-Trust Validators - Provides a validating resolver that cryptographically verifies DNSSEC chains of trust from root anchors.
- DNSSEC Signature Validation - Cryptographically verifies digital signatures on incoming DNS responses to ensure authenticity and prevent cache poisoning.
- Programmable Pipelines - Offers a programmable DNS server with a Python scripting interface and dynamic shared-library loading to customize resolution.
- Cache Backends - Supports external database backends to maintain a persistent second-level DNS cache.
- DNS Resolution Scripting - Runs custom Python scripts within the resolution pipeline to dynamically modify queries and answers.
- Resolution Pipeline Scripting - Offers a Python scripting interface to customize and modify incoming queries and outgoing answers dynamically.
- NAT64 Gateways - Acts as a NAT64 gateway, routing traffic from IPv6-only clients to IPv4-only servers using a specific prefix.
- DNS Query Filters - Applies policy zones to block responses or trigger actions based on query names or client IPs.
- Local Zone Views - Defines custom local zones to deliver tailored DNS responses to different groups of clients.
- EDNS Client Subnet Routing - Implements EDNS Client Subnet (ECS) routing to forward client address information for optimized location-aware responses.
- Encrypted DNS Servers - Provides an encrypted DNS server supporting secure communication protocols to prevent eavesdropping.
- Stub Zone Routing - Directs queries for specific domains to authoritative nameservers to access private or local data.
- Dynamic Library Loading - Supports loading external shared libraries at runtime to extend core functionality without recompilation.
- DNS Response Filtering - Implements policy-based response filtering to trigger specific routing or denial actions based on query names or client IPs.
- DNS Servers - Fast, secure, and recursive DNS resolver.
- DNS Servers - Validating, recursive, and caching DNS resolver.
