This article presents a comparison of the features, platform support, and packaging of many independent implementations of

Domain Name System The Domain Name System (DNS) is a hierarchical and distributed name service that provides a naming system for computers, services, and other resources on the Internet or other Internet Protocol (IP) networks. It associates various information ...

(DNS)

name server A name server is a computer application that implements a network service for providing responses to queries against a directory service. It translates an often humanly meaningful, text-based identifier to a system-internal, often numeric identi ...

software.

Servers compared

Each of these

DNS The Domain Name System (DNS) is a hierarchical and distributed name service that provides a naming system for computers, services, and other resources on the Internet or other Internet Protocol (IP) networks. It associates various informatio ...

servers is an independent implementation of the DNS protocols, capable of resolving DNS names for other computers, publishing the DNS names of computers, or both. Excluded from consideration are single-feature DNS tools (such as proxies, filters, and firewalls) and redistributions of servers listed here (many products repackage BIND, for instance, with proprietary user interfaces). DNS servers are grouped into several categories of specialization of servicing domain name system queries. The two principal roles, which may be implemented either uniquely or combined in a given product are: * Authoritative server:

authoritative name server A name server is a computer application that implements a network service for providing responses to queries against a directory service. It translates an often humanly meaningful, text-based identifier to a system-internal, often numeric identi ...

s publish DNS mappings for domains under their ''authoritative'' control. Typically, a company (e.g. "Acme Example Widgets") would provide its own authority services to respond to address queries, or for other DNS information, for ''www.example.int''. These servers are listed as being at the top of the authority chain for their respective domains, and are capable of providing a definitive answer. Authoritative name servers can be ''primary name servers'', also known as ''master'' servers, i.e. they contain the original set of data, or they can be ''secondary'' or ''slave name servers'', containing data copies usually obtained from synchronization directly with the primary server, either via a DNS mechanism, or by other data store synchronization mechanisms. * Recursive server: recursive servers (sometimes called "DNS caches", "caching-only name servers") provide DNS name resolution for applications, by relaying the requests of the client application to the chain of authoritative name servers to fully resolve a network name. They also (typically) cache the result to answer potential future queries within a certain expiration (

time-to-live Time to live (TTL) or hop limit is a mechanism which limits the lifespan or lifetime of data in a computer or network. TTL may be implemented as a counter or timestamp attached to or embedded in the data. Once the prescribed event count or times ...

) period. Most Internet users access a ''recursive server'' provided by their internet service provider to locate internet

hosts A host is a person responsible for guests at an event or for providing hospitality during it. Host may also refer to: Places * Host, Pennsylvania, a village in Berks County * Host Island, in the Wilhelm Archipelago, Antarctica People * ...

such as '' www.example.com''.

BIG-IP DNS

F5 Networks F5, Inc. is an American technology company specializing in application security, multi-cloud management, online fraud prevention, application delivery networking (ADN), application availability and performance, and network security, access, a ...

BIG-IP product line offers DNS as an authoritative or recursive server and adds additional security measures. Key advantage is to use the same application delivery controller to support DNS and application acceleration.

BIND BIND () is a suite of software for interacting with the Domain Name System (DNS). Its most prominent component, named (pronounced ''name-dee'': , short for ''name Daemon (computing), daemon''), performs both of the main DNS server roles, acting ...

BIND is the ''

de facto standard A ''de facto'' standard is a custom or convention that is commonly used even though its use is not required. is a Latin phrase (literally " of fact"), here meaning "in practice but not necessarily ordained by law" or "in practice or actuality, ...

'' DNS server. It is a

free software Free software, libre software, libreware sometimes known as freedom-respecting software is computer software distributed open-source license, under terms that allow users to run the software for any purpose as well as to study, change, distribut ...

product and is distributed with most Unix and Linux platforms, where it is most often also referred to as ''named'' (name daemon). It is the most widely deployed DNS server. Historically, BIND underwent three major revisions, each with significantly different architectures: BIND4, BIND8, and BIND9. BIND4 and BIND8 are now technically obsolete and not considered in this article. BIND9 is a ground-up rewrite of BIND featuring complete

DNSSEC The Domain Name System Security Extensions (DNSSEC) is a suite of extension specifications by the Internet Engineering Task Force (IETF) for securing data exchanged in the Domain Name System ( DNS) in Internet Protocol ( IP) networks. The protoco ...

support in addition to other features and enhancements.

Internet Systems Consortium Internet Systems Consortium, Inc., also known as ISC, is an American non-profit corporation that supports the infrastructure of the universal, self-organizing Internet by developing and maintaining core production-quality software, protocols, and ...

started development of a new version, BIND 10. Its first release was in April 2010, but ISC involvement concluded with the release of BIND 10 version 1.2 in April 2014. ISC cited a lack of resources to continue development of BIND 10, and they reaffirmed their commitment to BIND9. The BIND 10 codebase continues on as an open source project. It is not included in this comparison at this time.

Cisco Network Registrar Cisco Prime Network Registrar (CNR) is a Cisco software product that includes components for Domain Name System (DNS) services, Dynamic Host Configuration Protocol services, Trivial File Transfer Protocol (TFTP) services, and Simple Network Manag ...

CNR includes a commercial DNS server from

Cisco Systems Cisco Systems, Inc. (using the trademark Cisco) is an American multinational corporation, multinational digital communications technology conglomerate (company), conglomerate corporation headquartered in San Jose, California. Cisco develops, m ...

usually used in conjunction with the CNR DHCP (

Dynamic Host Configuration Protocol The Dynamic Host Configuration Protocol (DHCP) is a network protocol, network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the netw ...

) server. It supports high rates of dynamic update.

CoreDNS The Cloud Native Computing Foundation (CNCF) is a subsidiary of the Linux Foundation founded in 2015 to support cloud-native computing. History It was announced alongside Kubernetes 1.0, an open source container cluster manager, which was contri ...

CoreDNS is the recommended DNS server for

Kubernetes Kubernetes (), also known as K8s is an open-source software, open-source OS-level virtualization, container orchestration (computing), orchestration system for automating software deployment, scaling, and management. Originally designed by Googl ...

and graduated from the CNCF in 2019.

Dnsmasq dnsmasq is free software providing Domain Name System (DNS) caching, a Dynamic Host Configuration Protocol (DHCP) server, router advertisement and network boot features, intended for small computer networks. dnsmasq has low requirements for s ...

Dnsmasq is a lightweight, easy to configure DNS forwarder, designed to provide DNS (and optionally

DHCP The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a clie ...

and

TFTP The Trivial File Transfer Protocol (TFTP) is a simple Lockstep (computing), lockstep communication protocol for transmitting or receiving files in a client-server application. A primary use of TFTP is in the early stages of nodes booting on a l ...

) services to a small-scale network. It can serve the names of local machines which are not in the global DNS. Dnsmasq accepts DNS queries and either answers them from a small, local cache or forwards them to a real, recursive DNS server. It loads the contents of /etc/hosts, so that local host names which do not appear in the global DNS can be resolved.

djbdns The djbdns software package is a DNS implementation. It was created by Daniel J. Bernstein in response to his frustrations with repeated security holes in the widely used BIND DNS software. As a challenge, Bernstein offered a $1000 prize for the ...

Djbdns is a collection of DNS applications, including ''tinydns'', which was the second most used

DNS server in 2004. It was designed by Daniel J. Bernstein, author of

qmail qmail is a mail transfer agent (MTA) that runs on Unix. It was written, starting December 1995, by Daniel J. Bernstein as a more secure alternative to the popular Sendmail program. Originally license-free software, qmail's source code wa ...

, with an emphasis on security considerations. In March 2009, Bernstein paid $1000 to the first person finding a security hole in djbdns. The

source code In computing, source code, or simply code or source, is a plain text computer program written in a programming language. A programmer writes the human readable source code to control the behavior of a computer. Since a computer, at base, only ...

is not centrally maintained and was released into the public domain in 2007. There are multiple

forks In cutlery or kitchenware, a fork (from 'pitchfork') is a Eating utensil, utensil, now usually made of metal, whose long handle terminates in a head that branches into several narrow and often slightly curved tine (structural), tines with whic ...

and more than a dozen patches to add additional features to djbdns.

gdnsd

gdnsd is a DNS server designed for geographic balancing. gdnsd is the DNS server used by Wikipedia for its servers and networking.

Knot DNS Knot DNS is an open-source authoritative-only server for the Domain Name System. It was created from scratch and is actively developed by CZ.NIC, the .CZ domain registry. The purpose of this project is to supply an alternative open-source imple ...

Knot DNS is a

authoritative DNS server by CZ.NIC. Knot DNS aims to be a fast, resilient DNS server usable for infrastructure (root and TLD) and

hosting services. Knot DNS supports

signing and among others hosts root zone (B, K, and L

root name server A root name server is a name server for the root zone of the Domain Name System (DNS) of the Internet. It directly answers requests for records in the root zone and answers other requests by returning a list of the authoritative name servers for ...

s), several

top-level domain A top-level domain (TLD) is one of the domain name, domains at the highest level in the hierarchical Domain Name System of the Internet after the root domain. The top-level domain names are installed in the DNS root zone, root zone of the nam ...

Knot Resolver

Knot Resolver is an

open source Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use and view the source code, design documents, or content of the product. The open source model is a decentrali ...

modern resolver implementation designed for scalability, resiliency, and flexibility. Its core architecture is tiny and efficient, and most of the rich features are implemented as optional modules, which limits attack surface and improves performance. Many resolver features are available out-of-the-box as modules while keeping core tiny and efficient. Modular architecture provides a state-machine like API for extensions, such as C and Lua modules.

MaraDNS

MaraDNS is a

DNS server by Sam Trenholme that claims a good security history and ease of use. In order to change any DNS records, MaraDNS needs to be restarted. Like djbdns dnscache, the MaraDNS 2.0 stand-alone recursive resolver ("Deadwood") does not use threads.

Microsoft DNS Microsoft DNS is the name given to the implementation of domain name system services provided in Microsoft Windows operating systems. Overview The Domain Name System support in Microsoft Windows NT, and thus its derivatives Windows 2000, Windo ...

Windows DNS Server component of Microsoft DNS. The same software can be configured to support authoritative, recursive and hybrid mode. The software is integrated with

Active Directory Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. Windows Server operating systems include it as a set of processes and services. Originally, only centralized domain management used Active Direct ...

which makes it the default DNS software for many enterprise networks that are based on

. It also allows creating zones by the standard DNS

zone file A Domain Name System (DNS) zone file is a text file that describes a DNS zone. A DNS zone is a subset, often a single domain, of the hierarchical domain name structure of the DNS. The zone file contains mappings between domain names and IP add ...

. The software comes packaged as a role in

Windows Server Windows Server (formerly Windows NT Server) is a brand name for Server (computing), server-oriented releases of the Windows NT operating system (OS) that have been developed by Microsoft since 1993. The first release under this brand name i ...

. The server software is shipped with a

command line A command-line interface (CLI) is a means of interacting with software via command (computing), commands each formatted as a line of text. Command-line interfaces emerged in the mid-1960s, on computer terminals, as an interactive and more user ...

application dnscmd, a DNS management GUI wizard, and a DNS

PowerShell PowerShell is a shell program developed by Microsoft for task automation and configuration management. As is typical for a shell, it provides a command-line interpreter for interactive use and a script interpreter for automation via a langu ...

package. In Windows Server 2012, the Windows DNS added support for DNSSEC, with full-fledged online signing, with

Dynamic DNS Dynamic DNS (DDNS) is a method of automatically updating a name server in the Domain Name System (DNS), often in real time, with the active DDNS configuration of its configured hostnames, addresses or other information. The term is used to desc ...

and

NSEC3 The Domain Name System Security Extensions (DNSSEC) is a suite of extension specifications by the Internet Engineering Task Force (IETF) for securing data exchanged in the Domain Name System (DNS) in Internet Protocol ( IP) networks. The protocol ...

support, along with RSASHA and ECDSA signing algorithms. It provides an inbuilt key storage provider and support for any third party CNG compliant key storage provider. User interface and

support for managing DNS and DNSSEC were improved as well. In the Windows Server 2016, the DNS Server supports DNS policies using which the admins can have more control over the name resolution process.

NSD

NSD is a

authoritative server provided by NLNet Labs. NSD is a test-bed server for DNSSEC; new DNSSEC protocol features are often prototyped using the NSD code base. NSD hosts several

s, and operates three of the

root nameserver A root name server is a name server for the root zone of the Domain Name System (DNS) of the Internet. It directly answers requests for records in the root zone and answers other requests by returning a list of the authoritative name servers for ...

pdnsd pdnsd is a caching DNS proxy server created originally by Thomas Moestl and currently maintained by Paul Rombouts. pdnsd is configurable by a config file or using the program ''pdns-ctl'' that comes with the package. Unlike BIND, pdnsd st ...

Pdnsd is a caching DNS proxy server that stores cached DNS records on disk for long term retention. Pdnsd is designed to be highly adaptable to situations where net connectivity is slow, unreliable, unavailable, or highly dynamic, with limited capability of acting as an authoritative nameserver. It is licensed under the

GPL The GNU General Public Licenses (GNU GPL or simply GPL) are a series of widely used free software licenses, or ''copyleft'' licenses, that guarantee end users the freedom to run, study, share, or modify the software. The GPL was the first c ...

Posadis

Posadis is a

DNS server, written in C++, featuring

update support.

PowerDNS PowerDNS is a Name server, DNS server program, written in C++ and licensed under the GNU General Public License, GPL. It runs on most Unix derivatives. PowerDNS features a large number of different ''backends'' ranging from simple BIND style z ...

PowerDNS is a

DNS server with a variety of data storage back-ends and load balancing features. Authoritative and recursive server functions are implemented as separate applications, as well as a separate DNS caching proxy (dnsdist) which implements features such as DNS over HTTPS.

Secure64 DNS

DNS Authority is commercial authoritative name server software from Secure64, the company that built Genuinely Secure DNS applications and operating system and completely automated the deployment of DNSSEC. DNS Cache is scalable, highly secure recursive DNS software from Secure64 which provides built-in protection against high-volume denial of service attacks, including Pseudo Random Sub Domain (PRSD) attacks.

Simple DNS Plus Overview Simple DNS Plus is a DNS server software product that runs on x86 and x64 editions of Windows operating system. All options and settings are available directly from a Windows user interface. It provides wizards for common tasks such as ...

Simple DNS Plus is a commercial DNS server product that runs under Microsoft Windows with an emphasis on a simple-to-use

GUI Gui or GUI may refer to: People Surname * Gui (surname), an ancient Chinese surname, ''xing'' * Bernard Gui (1261 or 1262–1331), inquisitor of the Dominican Order * Luigi Gui (1914–2010), Italian politician * Gui Minhai (born 1964), Ch ...

. Maintenance of the software appears to have slackened in recent years.

Technitium DNS Server

Technitium DNS Server is a

free Free may refer to: Concept * Freedom, the ability to act or change without constraint or restriction * Emancipate, attaining civil and political rights or equality * Free (''gratis''), free of charge * Gratis versus libre, the difference betw ...

, opensource (GPLv3), cross platform, authoritative, caching and recursive DNS server software. It supports DNS-over-TLS,

DNS-over-HTTPS DNS over HTTPS (DoH) is a protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. A goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in ...

, and

DNS-over-QUIC The Domain Name System (DNS) is a hierarchical and distributed name service that provides a naming system for computers, services, and other resources on the Internet or other Internet Protocol (IP) networks. It associates various information ...

encrypted DNS protocols. It also supports

signing and validation for RSA and

ECDSA In cryptography, the Elliptic Curve Digital Signature Algorithm (ECDSA) offers a variant of the Digital Signature Algorithm (DSA) which uses elliptic-curve cryptography. Key and signature sizes As with elliptic-curve cryptography in general, the ...

algorithms with both NSEC and NSEC3. The DNS server also features blocking domain names using block lists and also supports using HTTP or SOCKS5, for transport of DNS requests over

Tor network Tor is a free overlay network for enabling anonymous communication. It is built on free and open-source software run by over seven thousand volunteer-operated relays worldwide, as well as by millions of users who route their Internet traffic ...

. The DNS server supports running independently developed plugins that can be used to process and respond to DNS requests. It also provides a HTTP API that can be used by 3rd party software to manage the DNS server.

Unbound

Unbound is a validating, recursive and caching DNS server designed for high performance. It was released on May 20, 2008 (version 1.0.0) as

licensed under the BSD license by NLnet Labs. It is installed as part of the base system in

FreeBSD FreeBSD is a free-software Unix-like operating system descended from the Berkeley Software Distribution (BSD). The first version was released in 1993 developed from 386BSD, one of the first fully functional and free Unix clones on affordable ...

starting with version 10.0, and in

NetBSD NetBSD is a free and open-source Unix-like operating system based on the Berkeley Software Distribution (BSD). It was the first open-source BSD descendant officially released after 386BSD was fork (software development), forked. It continues to ...

with version 8.0. A version is also available in

OpenBSD OpenBSD is a security-focused operating system, security-focused, free software, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by fork (software development), forking NetBSD ...

version 5.6 and beyond. (Previous versions of FreeBSD shipped with BIND.)

YADIFA

YADIFA is a BSD-licensed, memory-efficient DNS server written in C. The acronym YADIFA stands for ''Yet Another DNS Implementation For All''. It was created by

EURid EURid vzw (European Registry for Internet Domains) is the nonprofit organisation appointed by the European Commission as the domain name registry that operates the .eu top-level domain and its variants in other scripts – .ею (.eu in Cyrillic ...

, which operates the .eu top-level domain.

Features

Some DNS features are relevant only to recursive servers, or to authoritative servers. As a result, a feature matrix such as the one in this article cannot by itself represent the effectiveness or maturity of a given implementation. Another important qualifier is the server architecture. Some DNS servers provide support for both server roles in a single, "monolithic" program. Others are divided into smaller programs, each implementing a subsystem of the server. As in the classic Computer Science

microkernel In computer science, a microkernel (often abbreviated as μ-kernel) is the near-minimum amount of software that can provide the mechanisms needed to implement an operating system (OS). These mechanisms include low-level address space management, ...

debate, the importance and utility of this distinction is hotly debated. The feature matrix in this article does not discuss whether DNS features are provided in a single program or several, so long as those features are provided with the base server package and not with third-party add-on software.

Explanation of features

; Authoritative : A major category of DNS server functionality, see above. ; Recursive : A major category of DNS server functionality, see above. ; Recursion Access Control : Servers with this feature provide control over which hosts are permitted DNS recursive lookups. This is useful for load balancing and service protection. ; Secondary Mode (or Slave Mode) : Authoritative servers can publish content that originates from primary data storage (such as zone files or databases connected to business administration processes)--sometimes also called 'master' servers--or can be ''secondary'' (or ''slave'') servers, republishing content fetched from and synchronized with such primary servers. Servers with a "secondary mode" feature have a built-in capability to retrieve and republish content from other servers. This is typically, though not always, provided using the AXFR DNS protocol. ; Caching : Servers with this feature provide recursive services for applications, and cache the results so that future requests for the same name can be answered quickly, without a full DNS lookup. This is an important performance feature, as it significantly reduces the latency of DNS requests. ; DNSSEC : Servers with this feature implement some variant of the

protocols. They may publish names with resource record signatures (providing a "secure authority service"), and may validate those signatures during recursive lookups (providing a "secure resolver"). DNSSEC is becoming more widespread as the deployment of a DNSSEC root key has been done by

ICANN The Internet Corporation for Assigned Names and Numbers (ICANN ) is a global multistakeholder group and nonprofit organization headquartered in the United States responsible for coordinating the maintenance and procedures of several dat ...

. Deployment to individual sites is growing as top level domains start to deploy DNSSEC too. The presence of DNSSEC features is a notable characteristic of a DNS server. ; TSIG : Servers with this feature typically provide DNSSEC services. In addition, they support the TSIG (Transaction SIGnature) protocol, which allows DNS clients to establish a secure session with the server to publish

records or to request secure DNS lookups without incurring the cost and complexity of full DNSSEC support. ; IPv6 : Servers with this feature are capable of publishing or handling DNS records that refer to

IPv6 Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP), the communication protocol, communications protocol that provides an identification and location system for computers on networks and routes traffic ...

addresses. In addition to be fully IPv6 capable they must implement IPv6 transport protocol for queries and zone transfers in secondary/primary relationships and forwarder functions. ; Wildcard : Servers with this feature can publish information for wildcard records, which provide data about DNS names in DNS zones that are not specifically listed in the zone. ; Split horizon : Servers with the

split-horizon DNS In computer networking, split-horizon DNS (also known as split-view DNS, split-brain DNS, or split DNS, or Mirage) is the facility of a Domain Name System (DNS) implementation to provide different sets of DNS information, usually selected by the ...

feature can give different answers depending on the source IP address of the query.

Feature matrix

Platforms

In this overview of

operating system An operating system (OS) is system software that manages computer hardware and software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ...

support for the discussed DNS server, the following terms indicate the level of support: * ''No'' indicates that it does not exist or was never released. * ''Partial'' indicates that while it works, the server lacks important functionality compared to versions for other OSs; it is still being developed however. * ''Beta'' indicates that while a version is fully functional and has been released, it is still in development (e.g. for stability). * ''Yes'' indicates that it has been officially released in a fully functional, stable version. * ''Included'' indicates that the server comes pre-packaged with or has been integrated into the operating system. This compilation is not exhaustive, but rather reflects the most common platforms today.

Packaging

References

External links

Don Moore's May 2004 DNS Internet survey

* ttp://www.cs.cornell.edu/People/egs/beehive/dnssurvey.html Beehive/CoDoNS DNS Survey: July 2004
ITU ccTLD DNS Survey
{{DEFAULTSORT:Comparison Of Dns Server Software DNS server software DNS software