Implementation Status

This table lists the best understanding of  current status of DNS-over-TLS related features in the latest stable releases of a selection of commonly used DNS software.

If there are errors of glaring omission please email sara@sinodun.com 

Coming soon will be guides on how to use NGINX and other proxies to provide DNS-over-TLS, also see here.

See the DNS-over-TLS reference material page for more details on the indivudual features. 

Clients

Mode		Stub				Recursive resolver
Software		ldns (drill)	digit	getdns	BIND (dig)	getdns(a)	Unbound	BIND	Knot Res
TCP/TLS Features	TCP fast open(b)					P
	Connection reuse (Q/R, Q/R, Q/R)
	Pipelining of queries(Q,Q,Q,R,R,R)	n/a
	Process OOOR (Q1,Q2,R2,R1)	n/a
	EDNS0 Keepalive(c)
TLS Features	TLS encryption (Port 853)							(d)
	TLS authentication
	EDNS0 Padding

Servers

Mode		Recursive			Auth
Software		Unbound	BIND	Knot Res	NSD	BIND	Knot Auth
TCP/TLS Features	TCP fast open**
	Process Pipelined queries
	Provide OOOR	WIP			n/a	n/a	n/a
	EDNS0 Keepalive***	WIP
TLS Features	TLS encryption (Port 853)			WIP
	Provide TLS auth credentials			WIP
	EDNS0 Padding

KEY:

• Green square  - indicates latest release already supports this functionality
• Blue square - indicates that a patch is available in our git repo. See here for details: DNS-over-TLS patches
  
• Yellow square - indicates work in progress
• P - Requires building against a patched version of libunbound
  
  

(a)    getdns uses libunbound in recursive mode
(b)   not yet available on Windows 
(c)    Implies robust TCP connection management (see RFC7828 and RFC7766)
(d)   See this article for how to use stunnel with BIND to provide DNS-over-TLS - thanks Francis Dupont!

Note pipelining and OOOP are not applicable for synchronous applications.