A high-performance, secure DNS server implementation in Rust with modern features and comprehensive deployment options.
- UDP/TCP DNS Server - Standard DNS protocol support with automatic TCP fallback
- Recursive Resolution - Full recursive DNS resolution starting from root servers
- High-Performance Caching - Intelligent TTL-based caching with memory management
- EDNS0 Support - Extended DNS for larger UDP payloads
- DNS over HTTPS (DoH) - Encrypted DNS queries over HTTPS (RFC 8484)
- DNS over TLS (DoT) - Encrypted DNS queries over TLS (RFC 7858)
- Advanced Block Lists - Multiple format support (hosts, AdBlock, plain domains)
- Split-Horizon DNS - Different responses based on client IP ranges
- Prometheus Metrics - Comprehensive observability with Grafana-ready metrics
- Health Checks - Built-in health and readiness endpoints
- Structured Logging - JSON logging with configurable levels
- Performance Optimized - >50,000 QPS with sub-millisecond latency
# Clone the repository
git clone https://github.com/example/ferrous-dns
cd ferrous-dns
# Build the project
cargo build --release
# Run with default configuration
./target/release/ferrous-dns# Start DNS server on port 5353 (non-privileged)
./ferrous-dns --bind 127.0.0.1:5353
# Start with custom configuration
./ferrous-dns --config /etc/ferrous-dns/config.toml
# Enable verbose logging
./ferrous-dns --verbose# Test with dig
dig @127.0.0.1 -p 5353 example.com
# Test DNS over HTTPS (if enabled)
curl -H "Accept: application/dns-message" \
"https://localhost:443/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB"Ferrous DNS uses TOML configuration files. Here's a basic example:
[server]
bind_address = "0.0.0.0"
udp_port = 53
tcp_port = 53
max_tcp_connections = 1000
timeout_seconds = 5
[resolver]
enable_recursion = true
max_recursion_depth = 16
query_timeout_ms = 5000
[cache]
enabled = true
max_entries = 10000
min_ttl_seconds = 30
max_ttl_seconds = 604800
[protocols]
enable_doh = false
enable_dot = false
doh_port = 443
dot_port = 853
tls_cert_path = "/etc/ssl/certs/server.pem"
tls_key_path = "/etc/ssl/private/server.key"
[monitoring]
enable_metrics = true
metrics_port = 9090
enable_logging = true
[blocklist]
enabled = false
sources = [
"https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts",
"/etc/ferrous-dns/custom-blocklist.txt"
]
update_interval_hours = 24
response_type = "NXDOMAIN"Ferrous DNS is built with a modular architecture:
┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐
│ DNS Clients │◄──►│ DNS Server │◄──►│ Resolvers │
│ │ │ │ │ │
│ • Standard DNS │ │ • UDP/TCP │ │ • Recursive │
│ • DNS over TLS │ │ • DoH/DoT │ │ • Forwarding │
│ • DNS over HTTPS│ │ • Rate Limiting │ │ • Split-Horizon │
└─────────────────┘ └──────────────────┘ └─────────────────┘
│
┌────────▼─────────┐
│ Support Layer │
│ │
│ • Cache │
│ • Block Lists │
│ • Metrics │
│ • Logging │
└──────────────────┘
Benchmarks on modern hardware show:
- Query Throughput: >50,000 QPS
- Cache Performance: 85%+ hit rate, <1ms response time
- Memory Efficiency: <1MB per 10,000 cached records
- Concurrent Connections: 10,000+ simultaneous TCP/TLS connections
Access metrics at http://localhost:9090/metrics:
# HELP ferrous_dns_queries_total Total DNS queries received
# TYPE ferrous_dns_queries_total counter
ferrous_dns_queries_total{protocol="udp",record_type="A"} 1247
# HELP ferrous_dns_cache_hits_total Total DNS cache hits
# TYPE ferrous_dns_cache_hits_total counter
ferrous_dns_cache_hits_total 891
# HELP ferrous_dns_query_duration_seconds DNS query processing time
# TYPE ferrous_dns_query_duration_seconds histogram
ferrous_dns_query_duration_seconds_bucket{protocol="udp",result="success",le="0.001"} 756
- Health endpoint:
http://localhost:9090/health - Readiness endpoint:
http://localhost:9090/metrics(metrics availability indicates readiness)
- Run as non-root user - Use capabilities or reverse proxy for port 53
- Enable rate limiting - Protect against DDoS attacks
- Use TLS certificates - Proper certificates for DoT/DoH
- Regular updates - Keep dependencies updated with
cargo audit - Monitor logs - Watch for suspicious query patterns
Ferrous DNS is designed to resist:
- DNS amplification attacks
- Cache poisoning attempts
- Resource exhaustion attacks
- Malformed packet exploits
# Prerequisites
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source ~/.cargo/env
# Clone and build
git clone https://github.com/example/ferrous-dns
cd ferrous-dns
cargo build --release
# Run tests
cargo test
# Run benchmarks
cargo bench- Fork the repository
- Create a feature branch
- Add tests for new functionality
- Run
cargo fmtandcargo clippy - Submit a pull request
[Unit]
Description=Ferrous DNS Server
After=network.target
[Service]
Type=simple
User=ferrous-dns
Group=ferrous-dns
ExecStart=/usr/local/bin/ferrous-dns --config /etc/ferrous-dns/config.toml
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.targetFROM rust:1.70 as builder
WORKDIR /app
COPY . .
RUN cargo build --release
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*
COPY --from=builder /app/target/release/ferrous-dns /usr/local/bin/
EXPOSE 53/udp 53/tcp 443/tcp 853/tcp 9090/tcp
CMD ["ferrous-dns"]apiVersion: apps/v1
kind: Deployment
metadata:
name: ferrous-dns
spec:
replicas: 3
selector:
matchLabels:
app: ferrous-dns
template:
metadata:
labels:
app: ferrous-dns
spec:
containers:
- name: ferrous-dns
image: ferrous-dns:1.0.0
ports:
- containerPort: 53
protocol: UDP
- containerPort: 53
protocol: TCP
- containerPort: 9090
protocol: TCP
resources:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "512Mi"
cpu: "500m"Licensed under the MIT License. See LICENSE for details.
- Built with Hickory DNS (formerly Trust-DNS)
- Inspired by modern DNS servers like Knot Resolver and PowerDNS
- Thanks to the Rust community for excellent crates and tools
Production Ready: Ferrous DNS v1.0.0 is production-ready with comprehensive testing, monitoring, and security features. Deploy with confidence! 🚀