{"id":13587148,"url":"https://github.com/jedisct1/edgedns","last_synced_at":"2025-04-05T13:09:44.797Z","repository":{"id":37405538,"uuid":"51874424","full_name":"jedisct1/edgedns","owner":"jedisct1","description":"A high performance DNS cache designed for Content Delivery Networks","archived":false,"fork":false,"pushed_at":"2020-12-31T23:13:58.000Z","size":1001,"stargazers_count":500,"open_issues_count":3,"forks_count":56,"subscribers_count":29,"default_branch":"master","last_synced_at":"2024-05-09T15:53:08.807Z","etag":null,"topics":["cache","cdn","dns","rust","security"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"isc","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jedisct1.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-02-16T22:15:31.000Z","updated_at":"2024-05-08T13:22:37.000Z","dependencies_parsed_at":"2022-07-12T20:50:48.433Z","dependency_job_id":null,"html_url":"https://github.com/jedisct1/edgedns","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jedisct1%2Fedgedns","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jedisct1%2Fedgedns/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jedisct1%2Fedgedns/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jedisct1%2Fedgedns/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jedisct1","download_url":"https://codeload.github.com/jedisct1/edgedns/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247339158,"owners_count":20923014,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cache","cdn","dns","rust","security"],"created_at":"2024-08-01T15:06:02.896Z","updated_at":"2025-04-05T13:09:44.731Z","avatar_url":"https://github.com/jedisct1.png","language":"Rust","funding_links":[],"categories":["Rust"],"sub_categories":[],"readme":"[![Build Status](https://travis-ci.org/jedisct1/edgedns.svg?branch=master)](https://travis-ci.org/jedisct1/edgedns?branch=master)\n\n![EdgeDNS](https://raw.github.com/jedisct1/edgedns/master/edgedns.png)\n\nA high performance DNS cache designed for Content Delivery Networks, with\nbuilt-in security mechanisms to protect origins, clients and itself.\n\n# Precompiled binaries (recommended)\n\n* [Linux ARM64 (Debian package)](https://github.com/jedisct1/edgedns/releases/download/0.3.0/edgedns-0.3.0-aarch64-unknown-linux-gnu.deb)\n* [Linux ARM64 (Universal, glibc)](https://github.com/jedisct1/edgedns/releases/download/0.3.0/edgedns-0.3.0-aarch64-unknown-linux-gnu.tar.gz)\n* [Linux ARMv7 (Debian package, gnueabihf)](https://github.com/jedisct1/edgedns/releases/download/0.3.0/edgedns-0.3.0-armv7-unknown-linux-gnueabihf.deb)\n* [Linux ARMv7 (Universal, gnueabihf)](https://github.com/jedisct1/edgedns/releases/download/0.3.0/edgedns-0.3.0-armv7-unknown-linux-gnueabihf.tar.gz)\n* [Linux x86 (Debian package)](https://github.com/jedisct1/edgedns/releases/download/0.3.0/edgedns-0.3.0-i686-unknown-linux-gnu.deb)\n* [Linux x86 (Universal, glibc)](https://github.com/jedisct1/edgedns/releases/download/0.3.0/edgedns-0.3.0-i686-unknown-linux-gnu.tar.gz)\n* [Linux x86_64 (Debian package)](https://github.com/jedisct1/edgedns/releases/download/0.3.0/edgedns-0.3.0-x86_64-unknown-linux-gnu.deb)\n* [Linux x86_64 (Universal, glibc)](https://github.com/jedisct1/edgedns/releases/download/0.3.0/edgedns-0.3.0-x86_64-unknown-linux-gnu.tar.gz)\n* [MacOS x86_64](https://github.com/jedisct1/edgedns/releases/download/0.3.0/edgedns-0.3.0-x86_64-apple-darwin.tar.gz)\n\n# Installation from source\n\nEdgeDNS requires rust-nightly. Compile and install the server with:\n```sh\ngit clone -b 0.3.0 https://github.com/jedisct1/edgedns\ncd edgedns\ncargo install\n```\n\n# Quickstart\n\n1. Edit a copy of the [`edgedns.toml`](https://github.com/jedisct1/edgedns/blob/master/edgedns.toml) configuration file\n2. Run `edgedns -c /path/to/edgedns.toml`\n\nOn Linux, you may use that\n[sample systemd service](https://github.com/jedisct1/edgedns/blob/master/edgedns.service)\nto start it.\n\nEdgeDNS can protect authoritative servers (\"virtual DNS\" mode), or act\nas a local cache for responses received from a recursive server.\n\n### EdgeDNS as a cache for authoritative servers (\"virtual DNS\" mode)\n\nFor this mode, set the `type` property in the `[upstream]` section to\n`authoritative`:\n\n```toml\n[upstream]\n# Type of upstream servers: \"resolver\" or \"authoritative\"\ntype = \"authoritative\"\n```\n\nEdgeDNS will act as a \"secondary DNS server\" for the zones served by\none or more \"primary DNS servers\". The external IP address `edgedns`\nis listening to can be configured as a public authoritative server for\nthe zone.\n\nThis will reduce the load on the \"primary server\", mitigate common\nattacks, and ensure a continuity of service even if the primary server\nhas temporary outages.\n\nBinding as many ports as possible (`udp_ports` in the `[network]`\nsection) is recommended in this mode of operation. This may require\nsome adjustments to your system configuration. See below.\n\n### EdgeDNS as a local DNS cache\n\nFor this mode, set the `type` property in the `[upstream]` section to\n`resolver`:\n\n```toml\n[upstream]\n# Type of upstream servers: \"resolver\" or \"authoritative\"\ntype = \"resolver\"\n```\n\nAnd configure the local host to use `127.0.0.1` as a resolver. EdgeDNS\nwill cache responses, balance the load across the resolvers set, and\nimprove your experience by making DNS more reliable.\n\n# Operation\n\nEdgeDNS has two modes of operation:\n- In \"virtual DNS\" mode, it acts as an **authoritative** server, and\nsits between **authoritative** DNS servers and resolvers. It ensures\nthat only correct queries are sent to upstream servers, balances the\nload across multiple upstreams, reduces the load by caching recent and\nfrequent queries, mitigates DDoS attacks and does its best to respond\nto critical queries even when upstream servers are slow or\nunresponsive.\n- In \"resolver\" mode, EdgeDNS can act as a simple, non-recursive DNS\ncache, sitting between a recursive **resolver** and stub resolvers.\n\n\"virtual DNS\" is the default mode, but this can be changed with the\n`type` property in the `[upstream]` section.\n\nBy default, the load is distributed using jump consistent hashing,\nensuring that the upstream servers get a similar share, but queries for\na given zone always favor the same upstream server.\n\nAs an alternative, servers can be tried sequentially, and queries are\neventually sent to the first responsive server.\n\nThat behavior is controlled by the `strategy` property in the\n`[upstream]` section. `uniform` enables consistent hashing, `fallback`\nselects servers in sequence and `minload` uses the power-of-two-choices\nalgorithm.\n\nA unique feature of EdgeDNS is that it uses a fixed number of UDP\nsockets. Sockets designed to receive responses from upstream servers\nare all open at once, and are then kept open forever. Matching\nresponses with queries is entirely done by the application instead of\nthe kernel.\n\nAs a result, the server will not start if the maximum number of UDP\nports to use is larger than the maximum number of file descriptors\nallowed.\n\nTweaking `/etc/security/limits.conf` or using `ulimit -n` might thus\nbe required prior to starting the server.\n\nBy default, only `8` UDP ports are open. This is acceptable for a\nlocal cache (\"resolver mode\") sending queries to a local resolver on a\ntrusted network. In all other scenarios, raising this number as much\nas possible (up to `64511`) using the `udp_ports` property is highly\nrecommended.\n\n# Live metrics\n\nIf the `enabled` property is set to `true` in the `[webservice]`\nsection, EdgeDNS will serve live metrics that can be collected by the\n[Prometheus](https://prometheus.io/) time-series database.\n\nThe default URL to access these metrics is `http://0.0.0.0:9090/metrics`.\n\n# Note\n\nThis software is still a work in progress. More features are planned,\nwith a focus on automatic DDoS mitigation.\n\n# Features\n\n### Reliable\n\nEdgeDNS is written in Rust, which by design prevents common security\nand reliability issues while remaining extremely fast.\n\nEdgeDNS can thus be used as a protection layer for DNS resolvers and\nauthoritative servers.\n\nEdgeDNS has been running flawlessly on the public\n[scaleway-fr](https://fr.dnscrypt.info/) server since January 2016.\n\n### DNSSEC support\n\nEdgeDNS is fully compatible with DNSSEC.\n\n### Low memory usage\n\nIn virtual DNS mode, responses are cached independently instead of\nperforming zone transfers, in order to favor caching of hot records.\n\nWith a large number of zones, and an uneven distribution of queries\nacross records, this leads to a very low memory usage compared to\nsecondary servers keeping entire zones.\n\n### EDNS0 support\n\nEdgeDNS fully supports EDNS0 both to respond to clients, and to\ncommunicate with upstream servers. This minimizes the number of\nqueries requiring TCP and reduces latency.\n\n### Minimal truncated responses\n\nResponses that don't fit within the maximum payload size supported by\na client get a truncated response, whose content cannot be used by a\nresolver or stub resolver.\n\nInstead of forwarding truncated responses sent by authoritative\nservers, EdgeDNS directly synthesizes the shortest possible responses.\n\n### Correct support for the dns0x20 extension\n\nIn order to improve resistance against forgery, some clients support\nthe dns0x20 extension, which randomizes casing in DNS names. This\nshouldn't lead to distinct cache entries. The cache normalize names,\nbut respect the form initially sent by clients in its responses.\n\n### Coalescing of identical queries\n\nMultiple clients can be simultaneously waiting for the same cache\nentry to be filled.\n\nSimilar in-flight queries are coalesced, and the first received\nresponse is dispatched among all waiting clients.\n\n### Latency guarantee\n\nSlow authoritative servers can have a huge impact on clients, even if\nthis is a temporary situation.\n\nEdgeDNS does its best to guarantee a maximum latency. If a response\nthat needs to be refreshed doesn't get a response within a given time\nframe, EdgeDNS can directly respond with cached records in order to\navoid breaking the latency guarantee.\n\n### Short responses to ANY queries\n\nANY queries are commonly used to conduct DDoS attacks.\n\nThe ANY query type has been deprecated for a while, but not answering\nqueries with the ANY type breaks legacy software, namely Qmail.\n\nCloudflare handles `ANY` queries by synthesizing responses with `HINFO`\nrecords. EdgeDNS implements this proposal as well. It doesn't violate\nthe protocol, doesn't break Qmail and mitigate abuses, while not\nrequiring any interactions with authoritative servers.\n\n### Query validation\n\nOnly valid queries should be sent to authoritative servers. This\nmitigates common attacks exploiting vulnerabilities in resolvers\nand authoritative servers.\n\n### Negative caching\n\nThe absence of data is cached. Temporary errors such as `SERVFAIL`\nresponses are also cached for a short period of time, in order to\navoid hammering upstream servers.\n\n### Automatic failover\n\nOutages of upstream servers are quickly detected, and background\nprobes are sent to bring them back to the pool as soon as they get\noperational again.\n\n### Consistent hashing\n\nIn order to improve cache locality, the same questions should\npreferably be always sent to the same upstream servers.\n\nConsistent hashing limits the amount of reshuffling after servers are\nbeing flagged as down or back up, and is a strategy the proxy can use\nin order to distribute queries amount authoritative servers.\n\nAs an alternative, EdgeDNS can send data to a primary upstream\nservers, and fall back to a list of backup servers in case of an\noutage.\n\n### Resilience against temporary outages of authoritive servers\n\nIf authoritative servers cannot be reached for a given zone, and a\nprevious version of the response is available, EdgeDNS serves that\nversion instead of returning a server failure.\n\nIf authoritative responses are received, but with a significant delay,\nEdgeDNS responds with a previous version of the response, and updates\nits cache as soon as the update is effectively being received.\n\n### Resilience against cache pollution\n\nAn attacker could fill the cache with entries of little relevance, or\ninvalid entries, in order to reduce the cache efficiency, or partly\ndisrupt the service.\n\nIn order to protect against cache pollution, EdgeDNS uses the\nCLOCK-Pro algorithm. This algorithm separately tracks recently used\nand frequently used entries.\n\nA significant amount of new entries does not have a perceptible\nimpact on frequently asked DNS questions.\n\n### TCP slots reuse\n\nThe number of simultaneous connections coming from the same client IP\naddress is capped, and dynamically adjusted according to the total\nnumber of free slots.\n\nAfter the cap is reached, new connections recycle older connections\nfrom the same client IP. A single client opening many TCP connections\ndoesn't affect the general service availablity.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjedisct1%2Fedgedns","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjedisct1%2Fedgedns","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjedisct1%2Fedgedns/lists"}