Is the recursive DNS server really free?

Yes. The resolver is released under the MIT license and is free for personal and commercial use. You can download pre-built Linux binaries from GitHub Releases, or build from source with Cargo.

Does it validate DNSSEC?

Yes. The resolver performs full DNSSEC validation from the root trust anchors down to each leaf RRSIG. It supports RSA (SHA-256/512), ECDSA P-256/P-384, Ed25519, and the post-quantum ML-DSA-44 algorithm (DNSSEC Algorithm 18). Bogus chains return SERVFAIL when enforcement is enabled.

Does it forward to Google, Cloudflare, or Quad9?

No. The resolver performs iterative resolution itself, starting at the IANA root server system and following referrals down through TLD and authoritative nameservers. No third-party recursive resolver is contacted.

Does it support DNS-over-HTTPS and DNS-over-TLS?

Yes. The server ships with a DoH endpoint (RFC 8484, GET and POST) and a DoT listener (RFC 7858) on separate ports. Plain UDP and TCP on port 53 are also supported, along with a reverse-proxy mode that terminates TLS elsewhere.

How does it protect against cache poisoning and SSRF?

The resolver enforces strict bailiwick checks on referrals, rejects out-of-bailiwick glue, filters unsafe upstream IPs (private, loopback, link-local, CGNAT, and cloud metadata ranges), randomizes source ports and transaction IDs, and validates the full DNSSEC trust chain before caching any answer.

What hardware do I need to self-host it?

A modest VPS with 1 vCPU and 512 MB of RAM is enough for typical home or small-office use. Because the resolver is written in Rust, memory usage stays flat under load with no garbage collection pauses, so it scales smoothly on larger hardware too.

How do I verify the download is authentic?

Each release asset on GitHub includes a matching .sha256 checksum file. Run sha256sum -c on the downloaded tarball against the published checksum to verify integrity before extracting.

Does it support post-quantum DNSSEC?

Yes. In addition to classical algorithms, the resolver supports ML-DSA-44 (DNSSEC Algorithm 18) via the RustCrypto ml-dsa backend. Because ML-DSA-44 signatures are around 2,420 bytes, Algorithm 18 responses frequently exceed the 1,232-byte EDNS target, so the resolver automatically falls back to TCP when truncated.

FREE & OPEN-SOURCE RECURSIVE DNS SERVER · v1.0.4

A Privacy-First Recursive Resolver You
Actually Own.

Name: Unified Recursive DNS Server
Brand: AZBrand
Availability: InStock

Download a self-hosted iterative recursive DNS server written in Rust. Full DNSSEC validation including post-quantum ML-DSA-44, DNS-over-HTTPS and DNS-over-TLS, RFC 8767 stale caching, and SSRF-resistant resolution. No forwarders. No upstream logging.

Download v1.0.4 →Install Instructions

100% DNSSEC ValidatedML-DSA-44 Post-QuantumMIT Licensed

Live Resolver Output

Watch It Validate DNSSEC in Real Time

A standard dig +dnssec query returning the AD flag, plus the internal validation log.

unified-dns , live query trace

● AD: validated

Client Query

$ dig @127.0.0.1 cloudflare.com A +dnssec

; <<>> DiG 9.18.24 <<>> @127.0.0.1 cloudflare.com A +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41827
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0,
;;        ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;cloudflare.com.                IN      A

;; ANSWER SECTION:
cloudflare.com.         300     IN      A       104.16.132.229
cloudflare.com.         300     IN      A       104.16.133.229

;; Query time: 12 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Mon Sep 15 09:14:02 UTC 2026
;; MSG SIZE  rcvd: 73

Internal Validation Log

[DNSSEC] secure      .                DNSKEY verified (KSK-2017)
[DNSSEC] secure      com.             DS -> DNSKEY chain OK
[DNSSEC] secure      cloudflare.com.  RRSIG verified (alg 13)
[DNS]    resolved    cloudflare.com.  A  12ms  cache=MISS
[CACHE]  inserted    cloudflare.com.  A  ttl=300s  ad=1
[RRL]    allow       subnet 203.0.113.0/24  qps=1

Latest Release · v1.0.4

Download Pre-Built Binaries

Static Linux binaries for x86_64 and ARM64. Each archive ships with a matching SHA-256 checksum file.

Linux x86_64

unified-dns-linux-x86_64.tar.gz

2.55 MB

SHA-256

2c808cd5f1fa878027fb5956ff3e91f15826b6014efb0f1e8d46c1875f20a1cc

Download .sha256

Linux ARM64 (aarch64)

unified-dns-linux-aarch64.tar.gz

2.42 MB

SHA-256

a220e86e6c6f989a5da08c7e06c08739b77b9555ef0f95455dcfaede03894dba

Download .sha256

View all releases on GitHub →

Quick Install

Up and Running in Under 5 Minutes

Choose a binary install, build from source, or use the systemd unit below. Works on Debian, Ubuntu, Fedora, Arch, and any modern Linux distribution.

bash , download & verify

# 1. Pick your architecture (x86_64 shown; replace with aarch64 for ARM)
ARCH=x86_64
VERSION=v1.0.4
BASE="unified-dns-linux-${ARCH}.tar.gz"

# 2. Download the release archive and its checksum from GitHub
curl -fsSLO "https://github.com/AZBrandCanada/Rust-Recursive-DNS-Resolver/releases/download/${VERSION}/${BASE}"
curl -fsSLO "https://github.com/AZBrandCanada/Rust-Recursive-DNS-Resolver/releases/download/${VERSION}/${BASE}.sha256"

# 3. Verify the SHA-256 checksum before extracting
sha256sum -c "${BASE}.sha256"

# 4. Extract and install
tar -xzf "${BASE}"
sudo install -m 0755 unified-dns /usr/local/bin/unified-dns

# 5. (Optional) Grant privileged port binding without root
sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/unified-dns

# 6. Run it
unified-dns

Need a production deployment walkthrough? Contact our engineering team.

Optional: systemd service unit

Save as /etc/systemd/system/unified-dns.service to run the resolver on boot with an unprivileged user.

/etc/systemd/system/unified-dns.service

[Unit]
Description=Unified Recursive DNS Server
After=network.target

[Service]
Type=simple
User=unified-dns
Group=unified-dns
WorkingDirectory=/var/lib/unified-dns
ExecStart=/usr/local/bin/unified-dns

Environment="HOST=0.0.0.0"
Environment="DNS_PORT=53"
Environment="DOT_PORT=853"
Environment="DOH_PORT=443"
Environment="DOH_NO_TLS=0"
Environment="DNSSEC_ENFORCE=1"
Environment="MAX_STALE_SECS=300"
Environment="RATE_LIMIT_BURST=300"
Environment="RATE_LIMIT_PER_SEC=60"
Environment="CERT_PATH=/etc/letsencrypt/live/dns.example.com/fullchain.pem"
Environment="KEY_PATH=/etc/letsencrypt/live/dns.example.com/privkey.pem"
Environment="WARM_LIMIT=500"
Environment="WARM_CONCURRENCY=8"
Environment="RUST_LOG=info,doh_server=info"

Restart=always
RestartSec=3
LimitNOFILE=65535

# Hardening (optional but recommended)
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/unified-dns

[Install]
WantedBy=multi-user.target

For privileged ports (53, 853, 443) without running as root, grant the capability once:

sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/unified-dns

Core Engine Capabilities

Everything a Serious Resolver Needs

Every subsystem is designed around RFC compliance, not shortcuts.

1. Full DNSSEC Validation

RSA (SHA-256/512), ECDSA P-256/P-384, Ed25519, and post-quantum ML-DSA-44 (Algorithm 18). NSEC/NSEC3 negative proofs with an RFC 9276 iteration cap. Expired or unauthorized RRSIGs are rejected.

2. DoH + DoT Frontends

RFC 8484 DNS-over-HTTPS with GET and POST, strict Content-Type and Accept validation, and RFC 7858 DNS-over-TLS with a bounded handshake timeout. Reverse-proxy mode included.

3. RFC 8767 Stale Serving

When an upstream is unreachable, recently expired records are served with a 30-second positive TTL and AD=0 while a background task revalidates them. Configurable stale window via MAX_STALE_SECS.

4. SSRF & Poisoning Defenses

Strict bailiwick checks on referrals, out-of-bailiwick glue rejection, RFC 1918 / loopback / link-local / CGNAT / cloud-metadata filtering on upstreams, and full DNSSEC validation before any cache insert.

5. Rate Limiting & RRL

Per-subnet token buckets (/24 v4, /64 v6), duplicate-domain Response Rate Limiting with a TC=1 challenge, and instant drops on UDP ANY queries per RFC 8482. No locks on the hot path.

6. Iterative, Not Forwarding

Resolves directly from the IANA root servers down through TLDs to authoritative nameservers. No Google, Cloudflare, or Quad9 in the path. Truly self-hosted recursion.

Free to Self-Host. Paid When You Need a Hand.

The resolver itself is MIT-licensed and free forever. Optional support and managed hosting exist for teams that want them.

FREE FOREVER

Self-Hosted

$0 / forever

Full source code under the MIT license. Run it on your own hardware with no restrictions.

Full iterative resolver source code
DNSSEC validation (incl. ML-DSA-44)
DoH + DoT + UDP/TCP listeners
RFC 8767 stale caching
Pre-built Linux x86_64 & ARM64

Download v1.0.4

Managed Hosting

$20 / month

We run the resolver on hardened infrastructure in Canadian and EU regions. You get a private DoH/DoT endpoint and no servers to patch.

Private DoH + DoT endpoint
Automatic updates & CVE patching
Anycast-ready regional failover
Daily config backups
Zero query logging (enforced)

Request Managed Hosting

Enterprise Support

$500 / month

For ISPs, hosting providers, and enterprises running the resolver at scale.

Dedicated Slack / Matrix channel
< 1 hr P1 response SLA
Custom feature development hours
Deployment review & hardening audit
Commercial support contract

Talk to Engineering

Recursive DNS Server FAQ

Common questions about DNSSEC, DoH/DoT, self-hosting, and licensing.

Need Help Deploying?

Tell us about your environment — VPS, bare metal, or hybrid — and our engineers will help you plan a hardened self-hosted deployment.

Your Full Name

Email Address

Phone Number

Service Required

Estimated Budget / Retainer Range

Project Details / Goals

Security Verification

Loading…

A Privacy-First Recursive Resolver You Actually Own.