A Rust based DNS client, server, and resolver, built to be safe and secure from the ground up.
This repo consists of multiple crates:
| Library | Description |
|---|---|
| Hickory DNS |  Provides the hickory-dns binary for running a DNS server. |
| Proto |   Low-level DNS library, including message encoding/decoding and DNS transports. |
| Client |   Used for sending query, update, and notify messages directly to a DNS server. |
| Server |   Used to build DNS servers. The hickory-dns binary makes use of this library. |
| Resolver |   Utilizes the client library to perform DNS resolution. Can be used in place of the standard OS resolution facilities. |
| Recursor |   Performs recursive DNS resolution, looking up records from their authoritative name servers. |
NOTICE This project was rebranded from Trust-DNS to Hickory DNS and has been moved to the https://github.com/hickory-dns/hickory-dns organization and repo.
The current root key is bundled into the system, and used by default. This gives validation of DNSKEY and DS records back to the root. NSEC and NSEC3 are implemented.
Zones will be automatically resigned on any record updates via dynamic DNS. To enable DNSSEC, enable the dnssec-ring feature.
mdns)mdns)ANAME)dns-over-rustls, dns-over-native-tls, or dns-over-openssl)dns-over-https-rustls)1.70Hickory DNS uses just for build workflow management. While running cargo test at the project root will work, this is not exhaustive. Install just with cargo install just. A few of the just recipes require cargo-workspaces to be installed, a plugin to optimize the workflow around cargo workspaces. Install the plugin with cargo install cargo-workspaces.
Default tests
These are good for running on local systems. They will create sockets for
local tests, but will not attempt to access remote systems. Tests can also
be run from the crate directory, i.e. client or server and cargo test
just default
Default feature tests
Hickory DNS has many features, to quickly test with them or without, there are three targets supported, default, no-default-features, all-features:
just all-features
Individual feature tests
Hickory DNS has many features, each individual feature can be tested
independently. See individual crates for all their features, here is a not
necessarily up to date list: dns-over-rustls, dns-over-https-rustls,
dns-over-native-tls, dns-over-openssl, dns-dnssec-openssl,
dns-dnssec-openssl, dns-dnssec-ring, mdns. Each feature can be tested
with itself as the task target for just:
just dns-over-https-rustls
Benchmarks
Waiting on benchmarks to stabilize in mainline Rust.
hickory-dns base dir, to get all features, just pass the --all-features flag.cargo build --release -p hickory-dns
Available in 0.20
cargo install --bin resolve hickory-util
Or from source, in the hickory-dns directory
cargo install --bin resolve --path util
example:
$ resolve www.example.com.
Querying for www.example.com. A from udp:8.8.8.8:53, tcp:8.8.8.8:53, udp:8.8.4.4:53, tcp:8.8.4.4:53, udp:[2001:4860:4860::8888]:53, tcp:[2001:4860:4860::8888]:53, udp:[2001:4860:4860::8844]:53, tcp:[2001:4860:4860::8844]:53
Success for query name: www.example.com. type: A class: IN
www.example.com. 21063 IN A 93.184.215.14
Why are you building another DNS server?
Because of all the security advisories out there for BIND.
Using Rust semantics it should be possible to develop a high performance and safe DNS Server that is more resilient to attacks.
What is the MSRV (minimum stable Rust version) policy?
Hickory DNS will work to support backward compatibility with three Rust versions.
For example, if 1.50 is the current release, then the MSRV will be 1.47. The
version is only increased as necessary, so it's possible that the MSRV is older
than this policy states. Additionally, the MSRV is only supported for the no-default-features
build due to it being an intractable issue of trying to enforce this policy on dependencies.
For live discussions beyond this repository, please see this Discord.
Licensed under either of
at your option.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.