Sdns – Lightweight, fast recursive dns server with dnssec support
1–10 of 14 posts
Re: Sdns – Lightweight, fast recursive dns server with dnssec support
#2Love it!! Golang love!
Re: Sdns – Lightweight, fast recursive dns server with dnssec support
#3Will this:
docker run -d --name sdns -p 53:53 -p 53:53/udp -p 853:853 -p 8053:8053 -p 8080:8080 sdns
Give me a secure DNS box or do I have to do the TLS myself with say let’s encrypt?
Re: Sdns – Lightweight, fast recursive dns server with dnssec support
#4Will this: docker run -d --name sdns -p 53:53 -p 53:53/udp -p 853:853 -p 8053:8053 -p 8080:8080 sdns Give me a secure DNS box or do I have to do the TLS myself with say let’s encrypt?
What do you mean by "secure DNS box"? This is a DNSSEC-validating resolver, which means it will check DNSSEC signatures, for whatever that is worth to you. It won't encrypt your DNS traffic. It may accept DoH/DNS-TLS requests, but won't (AFAIK) make outgoing DoH requests, so all the requests you make will be visible from the server.
Re: Sdns – Lightweight, fast recursive dns server with dnssec support
#5Can anyone compare this to unbound?
Re: Sdns – Lightweight, fast recursive dns server with dnssec support
#6Can anyone compare this to unbound?
Unbound is probably more featureful (especially when it comes to DNSSEC, which, I mean, again, for what that's worth to you), but sdns is written in Golang. Unbound is written in C and has had at least one memory corruption vulnerability reported.
Re: Sdns – Lightweight, fast recursive dns server with dnssec support
#7Will this: docker run -d --name sdns -p 53:53 -p 53:53/udp -p 853:853 -p 8053:8053 -p 8080:8080 sdns Give me a secure DNS box or do I have to do the TLS myself with say let’s encrypt?
AFAICT This does not include like an ACME implementation or anything like that, so:
You will need to obtain a suitable TLS certificate (for which you will have generated a private key).
For this to be of practical use outside of a toy, you will probably need to obtain the certificate from a different CA since you would want an ipAddress SAN (a certificate for the IP address of your DNS server, not the hostname) so that remote systems can use this server without also needing DNS, since if they have perfectly good DNS why use this server?
For a toy you can self-sign a certificate and set your test systems to trust that self-signed cert or whatever.
Re: Sdns – Lightweight, fast recursive dns server with dnssec support
#8Can anyone compare this to unbound?
Unbound is probably more featureful (especially when it comes to DNSSEC, which, I mean, again, for what that's worth to you), but sdns is written in Golang. Unbound is written in C and has had at least one memory corruption vulnerability reported.
I'm definitely a fan of go over C. I was really happy with unbound as a local resolver for a good long time, but then started having DNS issues that would be cleared up by restarting unbound.
Re: Sdns – Lightweight, fast recursive dns server with dnssec support
#9Nice work. Been looking for a resolver with DoH support that’s built with Go. Cloudflared is just too buggy and not actively maintained.
Would love to see some support for Prometheus compatible metrics.
Re: Sdns – Lightweight, fast recursive dns server with dnssec support
#10Nice work. Been looking for a resolver with DoH support that’s built with Go. Cloudflared is just too buggy and not actively maintained. Would love to see some support for Prometheus compatible metrics.
There have been 6 releases of cloudflared in the last 2 months - https://github.com/cloudflare/cloudflared/releases