Knot DNS
Knot DNS is an open-source authoritative-only server for the Domain Name System. It was created from scratch and is actively developed by CZ.NIC, the .CZ domain registry. The purpose of this project is to supply an alternative open-source implementation of an authoritative DNS server suitable for TLD operators to increase overall security, stability and resiliency of the Domain Name System. It is implemented as a multi-threaded daemon, using a number of programming techniques and data structures to make the server very fast[1], notably Read-copy-update[2] or a special kind of a radix tree.
 | |
| Developer(s) | CZ.NIC |
|---|---|
| Initial release | November 3, 2011 |
| Stable release | 2.9.5
/ May 25, 2020 |
| Repository |  |
| Operating system | Unix-like |
| Type | DNS server |
| License | GPL license |
| Website | www |
Knot DNS uses a zone parser written in Ragel to achieve very fast loading of the zones at the startup. It is also able to add and remove zones on the fly by changing the configuration file and reloading the server using the 'knotc' utility.
Changelog
New in 1.2.0: Response Rate Limiting, Dynamic DNS, and a new remote control utility.
New in 1.3.0: new zone parser in Ragel (replaces zone compilation) and several client utilities (kdig, khost and knsupdate).
New in 1.4.0: automatic DNSSEC signing of the managed zones.
New in 1.5.0: query modules with two new modules: "Automatic forward/reverse records" and dnstap.
New in 1.6.0: persistent timers for slave zones (expire, refresh, and flush) using LMDB.
New in 2.0.0: new YAML-based configuration, and new DNSSEC implementation using GnuTLS.
New in 2.1.0[3]: dynamic configuration, PKCS#11 interface, and online DNSSEC signing.
New in 2.2.0[4]: Response Rate Limiting white listing, support for URI (RFC 7553) and CAA (RFC 6844) resource record types, interactive mode for 'knotc', new control interface for the server including simple Python bindings.
New in 2.3.0[5]: DNSSEC signing configured in server configuration, automatic NSEC3 resalting, zone operations over server control interface, TLS in kdig.
New in 2.4.0[6]: Unified LMDB based journal, new statistics module, automatic deletion of retired DNSSEC keys.
New in 2.5.0[7]: LMDB based KASP database, KSK rollover, dynamic modules, zone freeze/thaw, zone contents in journal.
New in 2.6.0[8]: On-slave DNSSEC signing, automatic DNSSEC algorithm rollover, Ed25519 algorithm support, TCP Fast Open.
New in 2.7.0[9]: Performance improvement, new module for DNS Cookies, new module for GeoIP, support for ECS
New in 2.8.0[10]: Offline-KSK, multithreaded DNSSEC signing, extended ACL for DDNS, zone update speed-up.
New in 2.9.0[11]: Significant zone update speed-up, TCP optimizations, configuration cleanup