Table of ContentsΒΆ
- dnsdist Overview
- Installing dnsdist
- Quickstart Guide
- Running and Configuring dnsdist
- Packet Policies
- Statistics
- acl-drops
- cache-hits
- cache-misses
- cpu-iowait
- cpu-steal
- cpu-sys-msec
- cpu-user-msec
- doh-query-pipe-full
- doh-response-pipe-full
- doq-response-pipe-full
- downstream-send-errors
- downstream-timeouts
- dyn-block-nmg-size
- dyn-blocked
- empty-queries
- fd-usage
- frontend-noerror
- frontend-nxdomain
- frontend-servfail
- latency-avg100
- latency-avg1000
- latency-avg10000
- latency-avg1000000
- latency-bucket
- latency-count
- latency-doh-avg100
- latency-doh-avg1000
- latency-doh-avg10000
- latency-doh-avg1000000
- latency-doq-avg100
- latency-doq-avg1000
- latency-doq-avg10000
- latency-doq-avg1000000
- latency-dot-avg100
- latency-dot-avg1000
- latency-dot-avg10000
- latency-dot-avg1000000
- latency-slow
- latency-sum
- latency-tcp-avg100
- latency-tcp-avg1000
- latency-tcp-avg10000
- latency-tcp-avg1000000
- latency0-1
- latency1-10
- latency10-50
- latency50-100
- latency100-1000
- no-policy
- noncompliant-queries
- noncompliant-responses
- outgoing-doh-query-pipe-full
- proxy-protocol-invalid
- queries
- rdqueries
- real-memory-usage
- responses
- rule-drop
- rule-nxdomain
- rule-refused
- rule-servfail
- rule-truncated
- security-status
- self-answered
- servfail-responses
- tcp-cross-protocol-query-pipe-full
- tcp-cross-protocol-response-pipe-full
- tcp-listen-overflows
- tcp-query-pipe-full
- trunc-failures
- udp-in-csum-errors
- udp-in-errors
- udp-noport-errors
- udp-recvbuf-errors
- udp-sndbuf-errors
- udp6-in-csum-errors
- udp6-in-errors
- udp6-noport-errors
- udp6-recvbuf-errors
- udp6-sndbuf-errors
- uptime
- Caching Responses
- Exporting statistics via Carbon
- Working with the dnsdist Console
- DNS-over-HTTP/3 (DoH3)
- DNS-over-HTTPS (DoH)
- DNS-over-QUIC (DoQ)
- DNS-over-TLS
- DNSCrypt
- Configuring Downstream Servers
- Dynamic Rule Generation
- Guides
- Server pools
- Loadbalancing and Server Policies
- Built-in webserver
- Advanced Topics
- Access Control
- Passing the source address to the backend
- TeeAction: copy the DNS traffic stream
- Lua actions in rules
- Runtime-modifiable IP address sets
- Rules for traffic exceeding QPS limits
- eBPF Socket Filtering
- Performance Tuning
- SNMP support
- AXFR, IXFR and NOTIFY
- Running multiple instances
- Out-of-order
- OCSP Stapling
- TLS Certificates Management
- TLS Sessions Management
- Internal Design
- Asynchronous processing
AF_XDP/XSK- EDNS Client Subnet Zero Scope
- Reference Guides
- Rule Actions
- Configuration Reference
- Constants
- ComboAddress
- Netmask
- NetmaskGroup
- DNSName objects
- DNSNameSet objects
- The DNSQuestion (
dq) object - DNSResponse object
- DNSHeader (
dh) object - EDNSOptionView object
- AsynchronousObject object
- eBPF functions and objects
- DNSCrypt objects and functions
- DNS Parser
- DNSRecord object
- Protobuf Logging Reference
- dnstap Logging Reference
- Carbon export
- SNMP reporting
- Tuning related functions
- Key Value Store functions and objects
- Logging
- Webserver-related objects
- Rules management
- Rule selectors
- SVCRecordParameters
- Custom Metrics
- XSK / AF_XDP functions and objects
- Manual Pages
- Changelog
- 1.9.8
- 1.9.7
- 1.8.4
- 1.9.6
- 1.9.5
- 1.9.4
- 1.9.3
- 1.9.2
- 1.9.1
- 1.9.0
- 1.9.0-rc1
- 1.8.3
- 1.9.0-alpha4
- 1.9.0-alpha3
- 1.9.0-alpha2
- 1.8.2
- 1.7.5
- 1.9.0-alpha1
- 1.8.1
- 1.7.4
- 1.8.0
- 1.8.0-rc3
- 1.8.0-rc2
- 1.8.0-rc1
- 1.7.3
- 1.7.2
- 1.7.1
- 1.7.0
- 1.7.0-rc1
- 1.7.0-beta2
- 1.7.0-beta1
- 1.7.0-alpha2
- 1.7.0-alpha1
- 1.6.1
- 1.6.0
- 1.5.2
- 1.6.0-rc2
- 1.6.0-rc1
- 1.6.0-alpha3
- 1.6.0-alpha2
- 1.6.0-alpha1
- 1.5.1
- 1.5.0
- 1.5.0-rc4
- 1.5.0-rc3
- 1.5.0-rc2
- 1.5.0-rc1
- 1.5.0-alpha1
- 1.4.0
- 1.4.0-rc5
- 1.4.0-rc4
- 1.4.0-rc3
- 1.4.0-rc2
- 1.4.0-rc1
- 1.4.0-beta1
- 1.4.0-alpha2
- 1.4.0-alpha1
- 1.3.3
- 1.3.2
- 1.3.1
- 1.3.0
- 1.2.1
- 1.2.0
- 1.1.0
- 1.1.0-beta2
- 1.1.0-beta1
- 1.0.0
- 1.0.0-beta1
- 1.0.0-alpha2
- 1.0.0-alpha1
- Upgrade Guide
- Security Advisories
- PowerDNS Security Advisory 2024-03: Transfer requests received over DoH can lead to a denial of service in DNSdist
- PowerDNS Security Advisory for dnsdist 2018-08: Record smuggling when adding ECS or XPF
- PowerDNS Security Advisory 2017-02 for dnsdist: Alteration of ACLs via API authentication bypass
- PowerDNS Security Advisory 2017-01 for dnsdist: Crafted backend responses can cause a denial of service
- PowerDNS Security Policy
- Glossary
- PowerDNS/dnsdist license
- End of life statements