DNS Privacy Project

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 58 Next »

Implementation Status

This table lists the best understanding of the current status of DNS-over-TLS related features in the latest stable releases of a selection of open source DNS software.

If there are errors or glaring omission please email sara@sinodun.com 

Coming soon will be guides on how to use NGINX and other proxies to provide DNS-over-TLS, also see here. Note that this will still require the nameserver to have robust TCP capabilities (as described in Sections 6.2.2 and 10 of RFC7766) for production level service. Any server that fully implements EDNS0 Keepalive (RFC7828) should meet this criteria. 

See the DNS-over-TLS reference material page for more details on the individual features. 

Clients

Mode

Stub 

Recursive resolver

Software

ldns

(drill)

digit

getdns

BIND

(dig)

Go
DNS 

Knot

(kdig)

getdns(a)

UnboundBIND

Knot

Res

 

 

TCP/TLS Features

TCP fast open(b) (tick)

(tick)

   

P

  (tick)
Connection reuse (Q/R, Q/R, Q/R) (tick)

(tick)

(tick)    (tick)(tick)

Pipelining of queries(Q,Q,Q,R,R,R)

n/a(tick)

(tick)

(tick)    (tick)(tick)
Process OOOR (Q1,Q2,R2,R1)n/a (tick)

(tick)

(tick)    (tick)(tick)
EDNS0 Keepalive(c)  (tick)       

 

 

TLS Features

TLS encryption (Port 853) (tick)(tick)   (tick)(tick)  
TLS authentication  (tick)       
EDNS0 Padding  (tick)       

Servers

ModeRecursiveAuth
Software

Unbound

BIND

Knot

Res

NSDBIND

Knot

Auth

 

TCP/TLS Features

TCP fast open**  (tick)  (tick)

Process Pipelined queries

(tick)(tick)(tick)(tick)(tick)(tick)
Provide OOORWIP(tick)(tick)n/an/an/a
EDNS0 Keepalive***WIP     

 


TLS Features

TLS encryption (Port 853)(tick)(d)WIP   
Provide TLS auth credentials(tick)(d)WIP   
EDNS0 Padding  WIP   

 

KEY:

  • Green square (tick) - indicates latest release already supports this functionality
  • Blue square - indicates that a patch is available in our git repo. See here for details: DNS-over-TLS patches
  • Yellow square - indicates work in progress, or availabe in next release
  • P - Requires building against a patched version of libunbound

(a)    getdns uses libunbound in recursive mode
(b)    not yet available on Windows 
(c)    Implies robust TCP connection management (see RFC7828 and RFC7766)
(d)   See this article for how to use stunnel with BIND to provide DNS-over-TLS - thanks Francis Dupont!

Note pipelining and OOOP are not applicable for synchronous applications. 

 

  • No labels