release of the caching DNS server , responsible for recursive name resolution. PowerDNS Recursor is built on the same codebase as PowerDNS Authoritative Server, but the recursive and authoritative DNS servers of PowerDNS evolve within different development cycles and are released as separate products. The project code is licensed under GPLv2.
The server provides tools for remote statistics gathering, supports instant restart, has a built-in engine for connecting handlers in Lua, fully supports DNSSEC, DNS64, RPZ (Response Policy Zones), and allows connecting blacklists. There is an option to record resolution results as BIND zone files. To ensure high performance, modern connection multiplexing mechanisms in FreeBSD, Linux, and Solaris (kqueue, epoll, /dev/poll) are used, as well as a high-performance DNS packet parser capable of handling tens of thousands of parallel requests.
In the new version:
- To prevent information leakage about the requested domain and enhance privacy, the mechanism is enabled by default (), operating in 'relaxed' mode. The core idea of the mechanism is that the resolver does not mention the full name of the queried host in its requests to the upstream name server. For example, when determining the address for the host foo.bar.baz.com, the resolver will send a request 'QTYPE=NS, QNAME=baz.com' to the authoritative server for the zone '.com', not mentioning 'foo.bar'. Currently, it operates in 'relaxed' mode.
- The possibility of logging outgoing requests to the authoritative server and their responses in dnstap format has been implemented (to use this feature, the build must include the '--enable-dnstap' option).
- Simultaneous processing of multiple incoming requests over a TCP connection has been implemented, returning results as they are ready rather than in the order of the requests in the queue. The limit of concurrent requests is defined by the settingĀ«.
- The technique for tracking new domains has been implemented (Newly Observed Domain), which can be used to identify suspicious domains or domains associated with malicious activities, such as spreading malware, participation in phishing, and controlling botnets. The method is based on identifying domains that have not been previously accessed and analyzing these new domains. Instead of tracking new domains across a full database of all previously viewed domains, which requires significant resources, NOD uses a probabilistic structure. (Stable Bloom Filter), which minimizes memory and CPU consumption. To enable this in the settings, specify 'new-domain-tracking=yes'.
- When running under systemd, the PowerDNS Recursor process now runs as the unprivileged user pdns-recursor instead of root. For systems without systemd and without chroot, the default directory for storing the management socket and pid file is now /var/run/pdns-recursor.
Additionally, release , a high-performance authoritative DNS server (the resolver is implemented as a separate application), supporting all modern DNS features. The project is developed by the Czech name registry CZ.NIC, written in C, and under the GPLv3 license.
KnotDNS is designed for high performance in query processing, employing a multi-threaded, and largely non-blocking implementation, well-scalable on SMP systems. Features include on-the-fly zone addition and removal, zone transfer between servers, DDNS (dynamic updates), NSID (RFC 5001), EDNS0 extensions, and DNSSEC (including NSEC3), along with response rate limiting (RRL).
In the new release:
- A setting āremote.block-notify-after-transferā has been added to disable NOTIFY message sending;
- Experimental support for the Ed448 algorithm in DNSSE has been implemented (requires GnuTLS 3.6.12+ and yet-to-be-released );
- A ālocal-serialā parameter has been added in keymgr to retrieve or set the SOA serial number for a signed zone in the KASP database;
- Keymgr has added support for importing Ed25519 and Ed448 keys in BIND DNS server format;
- The default setting value for āserver.tcp-io-timeoutā has been increased to 500 ms, while ādatabase.journal-db-max-sizeā has been reduced to 512 MiB on 32-bit systems.
Source: opennet.ru
