Hickory DNS home

Memory-safe DNS, written in Rust

Hickory DNS provides a stub resolver, a recursive resolver and an authoritative server and a set of Rust libraries for everything from parsing a DNS message to resolving a name. It is open source and extensively tested.

Why Hickory DNS

  • Memory safe

    Message parsing, zone handling and resolution are written in safe Rust, removing whole classes of vulnerabilities that have long affected DNS software written in C.

  • Encrypted transports

    DNS over TLS, HTTPS, QUIC and HTTP/3, for both serving and resolving, built on rustls with your choice of aws-lc-rs or ring for cryptography.

  • DNSSEC

    Validation back to the root trust anchor, including authenticated denial of existence with NSEC and NSEC3. The server can sign zones online and re-sign them on every update.

  • Portable

    Runs on Linux, macOS, Windows and Android, using each platform’s native resolver configuration. The protocol crate also works in no_std environments and WebAssembly.

  • Extensively tested

    Extensive coverage via unit tests, integration tests and conformance tests help improve reliability and correctness of the implementation.

  • Permissively licensed

    Dual-licensed under MIT and Apache 2.0, so it fits in commercial products and other open source projects alike.

Run a DNS server

The hickory-dns binary is a single, self-contained server configured with one TOML file. Run it as an authoritative name server, a resolver, or both at once.

  • Authoritative

    Serve primary and secondary zones from standard zone files or from SQLite, with zone transfers under your control.

  • Dynamic updates

    Accept updates authenticated with TSIG or SIG(0), journaled to SQLite and re-signed automatically when DNSSEC is on.

  • Recursive resolver

    Resolve from the root servers with DNSSEC validation, per-type cache policies, and opportunistic encryption to authoritative servers.

  • Forwarder

    Forward queries to upstream resolvers over plain or encrypted transports, with caching.

  • Blocklists and access control

    Filter names with blocklists, and allow or deny clients by network.

  • Easy to operate

    Prometheus metrics, systemd integration, privilege dropping after binding ports, and a Docker image.

Build with the libraries

Every part of the server is a library you can use on its own. The crates are async and built on Tokio, and each optional protocol or dependency sits behind a Cargo feature.

  • Stub resolver

    hickory-resolver

    An in-process replacement for the system resolver. Reads the system configuration on Unix, macOS, Windows and Android; prefers the fastest upstream name servers. DNSSEC validation and encrypted transports are optional features.

  • Recursive resolver

    hickory-resolver with the recursor feature

    Full iterative resolution starting from the root servers, with DNSSEC validation, for applications that need answers without trusting an upstream resolver.

  • Server framework

    hickory-server

    The building blocks of hickory-dns: listeners for every transport, plus zone handlers for authoritative data, forwarding, recursion and blocklists, or your own.

  • Protocol

    hickory-proto

    DNS message encoding and decoding and a wide range of record types. Supports no_std.

  • Transports

    hickory-net

    Asynchronous DNS clients and connections over UDP, TCP, TLS, HTTPS, QUIC and HTTP/3.

Android uses hickory-proto to parse DNS responses in the firmware of the Pixel 10.