Takelan DNS Server

Answers

• Authoritative serving and recursive resolution, with a cache that can serve stale answers and prefetch.
• UDP and TCP on port 53, DNS over TLS (RFC 7858), DNS over HTTPS (RFC 8484, GET and POST) and DNS over QUIC (RFC 9250). The encrypted listeners are switched on in configuration.
• EDNS(0), DNS cookies, NSID, extended DNS errors and EDNS client subnet.
• BIND9 zone files and named.conf, parsed and never rewritten. Wildcards, DNAME, glue and SVCB/HTTPS records (RFC 9460).
• A check mode that tells you which named.conf directives and zones it can serve, before you switch.

Zones and changes

• Zone transfers: AXFR and IXFR, NOTIFY and secondary zones. Transfers and updates are denied unless you allow them.
• Dynamic updates (RFC 2136) with TSIG (RFC 8945), and catalog zones (RFC 9432).
• Dynamic DNS keys: a signed HTTP update for one name, for routers and scripts.
• Zone versions with diff and rollback. A comment and a few metadata keys on each zone.
• Hot reload without a restart. Backup, restore and verify from the command line.

DNSSEC

• Online signing, with one combined key per zone by default. Algorithms 8, 10, 13 (the default), 14 and 15.
• Authenticated denial with NSEC3 (the default) or NSEC, with correct wildcard proofs. CDS and CDNSKEY records are served.
• It prints the DS records to publish at your registrar. It reads and writes standard BIND key files.
• Multi-signer (RFC 8901, model 2), so a zone can be signed by more than one provider, or by every node of a cluster, each with its own keys.
• A validating forwarder for recursed answers is built. Its notes say to check how far it is wired in your release before you rely on it.

Smart answers

• Health-aware pools: a name answers with the members that are alive now. Priority tiers, weights, N-of-M and standby members.
• Probes over TCP, UDP, HTTP, HTTPS, DNS and TLS, and a local command check that never leaves its node.
• GeoDNS: named country and continent regions, or the nearest healthy datacenter by distance, with failover.
• All of it is off until you switch it on, and it fails open to the plain zone answer.

Clusters

• Nodes push zone, record and config changes to each other, with retries and a catch-up pass so a node that was away converges when it returns.
• Last writer wins, with a fixed tie-break. A zone delete spreads too, and every node keeps a marker so an old write cannot bring the zone back.
• Credentials sync on their own channel. Node-local settings such as identity, listen ports and file paths never leave their node.
• The management plane uses TLS with a cluster certificate authority the nodes create themselves.

Defense

• Rate limits per client, response rate limiting and a guard against amplification.
• Defense Intelligence: each node watches its own traffic for query floods, random-name floods, amplification, spoofed sources, connection floods and password guessing, and shares what it finds with its peers.
• Mitigations are throttle, block, force TCP, and a limit on made-up names under one domain. Each one expires on its own, and there are caps and a never-block list.
• A node starts in observe mode: it detects, records and shares, and enforces nothing until you switch it to enforce.

Running it

• One binary. It can take the place of the named and rndc programs and keep your units and flags.
• A dashboard and a REST API, with API keys that carry permissions and can be limited to some domains, and web roles.
• Analytics and per-domain query log and stats. A multi-worker mode, by default one process per core up to a cap.
• Packages for deb and rpm, a tarball, a self-extracting installer and a Docker image.

Zones come from Utilities

You add a domain in Utilities. It checks the name, checks ownership by delegation or a TXT record, lints the zone on a node, then writes it to one node. The node pushes it to the others, and Utilities confirms that each one now shows the new serial. A node that lags gets a repair task that is retried until it matches.

Dynamic DNS goes through a relay

A router or script signs its update with a key. A relay in Utilities checks the key, the time and the signature, then forwards it to a node, which checks it again. The nodes' management APIs stay private. The key lives on the nodes and is copied to each one. Utilities keeps an encrypted copy of the secret to check the signature.

DNSSEC keys stay on their node

Each node signs with its own keys. The nodes swap only the public keys, so every node serves the same key set and the same DS records. Utilities shows the state per node and the DS records to publish. It refuses to turn signing on unless every node agrees. Nothing is published at your registrar for you.

Logs and stats flow back

Each node keeps a query log. Utilities asks every node for your domain only, merges the answers and shows the log and stats. Client addresses are shortened by default, and the retention is set per domain.

Healthcheck watches the nodes

Healthcheck probes each node for a DNS answer to a known name, its HTTPS status and port 53 over TCP and UDP. A separate Domain name check runs more than 100 tests on any domain.

Attacks become reports

When a node stops a flood or a password-guessing run, it can report the heaviest address to the Takelan reputation API. It needs no key for that, and an anonymous report counts for less. A node can also look up the standing of its heaviest clients and throttle or block the ones that are poor or blocked.

Utilities holds the rules

Ownership, quotas, roles, versions, the audit log and the per-domain privacy settings live in Utilities. Zone contents and DNSSEC keys live on the nodes. Utilities talks to a node over HTTPS with a pinned certificate authority, and holds only a reference to the credential, never the value.