This article is a comparison of DNS server software, comparing the features, platform support, and packaging of independent implementations of DNS. DNS may refer to: Look up DNS in Wiktionary, the free dictionary. ... The Domain Name System (DNS) associates various sorts of information with domain names; most importantly, it serves as the phone book for the Internet by translating human-readable computer hostnames, e. ...

Servers compared

Each of these DNS servers is an independent implementation of the DNS protocols, capable of resolving DNS names for other computers, publishing the DNS names of computers, or both. Excluded from consideration are single-feature DNS tools (such as proxies, filters, and firewalls) and redistributions of servers listed here (many products repackage BIND, for instance, with proprietary user interfaces).

DNS servers are grouped into several categories of specialization of servicing domain name system queries. The two principal roles, which may be implemented either uniquely or combined in a given product are:

• Authoritative server: authoritative name servers publish DNS mappings for domains under their authoritative control. Typically, a company (e.g. "Acme Example Widgets") would provide its own authority services to respond to address queries, or for other DNS information, for www.example.int. These servers are listed as being at the top of the authority chain for their respective domains, and are capable of providing a definitive answer. Authoritative name servers can be primary name servers, also known as master servers, i.e. they contain the original set of data, or they can be secondary or slave name servers, containing data copies usually obtained from synchronization directly with the master server, either via a DNS mechanism, or by other data store synchronization mechanisms.

• Recursive Servers: recursive servers (sometimes called "DNS caches", "caching-only name servers") provide DNS name resolution for applications, by relaying the requests of the client application to the chain of authoritative name servers to fully resolve a network name as well, usually, caching the result to answer potential future queries within a certain expiration (time-to-live) period. Most Internet users access a recursive server provided by their internet service provider to locate sites such as www.google.com.

In computing, a name server (also called nameserver) consists of a program or computer server that implements a name-service protocol. ... Time to live (sometimes abbreviated TTL) is a limit on the period of time or number of iterations or transmissions in computer and computer network technology that a unit of data (e. ...

BIND

The de facto standard open-source DNS server. BIND ships on most Unix platforms, where it is most often also referred to as named (name daemon) and is the most widely deployed DNS server. Historically, there were three major versions of BIND, each with significantly different architectures: BIND4, BIND8, and BIND9. The first two of these are now technically obsolete. This page refers to BIND9, a ground-up rewrite of BIND featuring full DNSSEC support. BIND (Berkeley Internet Name Domain, previously: Berkeley Internet Name Daemon) is the most commonly used DNS server on the Internet, especially on Unix-like systems, where it is a de facto standard. ... De facto is a Latin expression that means in fact or in practice. It is commonly used as opposed to de jure (meaning by law) when referring to matters of law or governance or technique (such as standards), that are found in the common experience as created or developed without...

Microsoft DNS

The DNS server provided with Windows Server, a key component of Microsoft's Active Directory, and therefore one of the most widely deployed implementations of the DNS. The DNS support in Microsoft Windows NT (and thus its derivatives Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003) comprises two clients and a server. ... Windows Server may refer to: Windows 2000 Server, the release based on Windows 2000 Windows Server 2003, the current release of Windows Server Windows Server Longhorn, the upcoming release of Windows Server Windows Home Server, an upcoming server operating system intended for home use Microsoft Servers, a family of servers... Typically Active Directory is managed using the graphical Microsoft Management Console. ...

djbdns

The second most popular open-source DNS server, designed with better security features over its predecessors by Daniel J. Bernstein, author of qmail. Designed as a response to earlier BIND versions with a history of potential security flaws. The code is not actively maintained, but was released into the public domain in 2007. djbdns is a simple and secure DNS implementation created by Daniel J. Bernstein because he was fed up with repeated BIND security holes. ... Daniel Julius Bernstein (sometimes known simply as djb; born October 29, 1971) is a professor at the University of Illinois at Chicago, a mathematician, a cryptologist, and a programmer. ... qmail is a mail transfer agent that runs on Unix. ...

Dnsmasq

Dnsmasq is a lightweight, easy to configure, DNS forwarder and local resolver (and DHCP server) and is usually integrated in home networking routers. Dnsmasq is a lightweight, easy to configure, DNS forwarder and DHCP server. ...

Simple DNS Plus

A popular Windows DNS server product with emphasis on a simple-to-use GUI. Simple DNS Plus is a popular DNS server software product that runs on the Windows operating system running on x86 and x64 hardware. ... GUI can refer to the following: GUI is short for graphical user interface, a term used to describe a type of interface in computing. ...

NSD

A popular open-source authoritative server provided by NLNet Labs. NSD is a test-bed server for DNSSEC; new DNSSEC protocol features are often prototyped using the NSD code base. NSD hosts several top-level domains, and operates three of the root nameservers.^{[citation needed]} In Internet computing, NSD (for name server daemon) is a server program for the Domain Name System. ... “TLD” redirects here. ... The AMS-IX mirror of the K root-server. ...

PowerDNS

An open-source DNS server with a variety of data storage back-ends and load balancing features. Authoritative and recursive server functions are implemented as separate applications. It is notable perhaps as the DNS implementation relied on by Wikipedia. PowerDNS is a versatile DNS server, written in C++ and licensed under the GPL. It runs on most Unix derivatives and on Microsoft Windows. ...

MaraDNS

An open source DNS server by Sam Trenholme that claims a good security history and easy of use. MaraDNS is a security-aware Domain Name System (DNS) implementation. ...

ANS

A commercial authoritative server from Nominum, a company founded by Paul Mockapetris, the inventor of the DNS. ANS was designed to meet the needs of top level domain servers. The Authoritative Name Server (ANS) is high-end commercial authority-only DNS server software product from Nominum, a company founded by Paul Mockapetris, the inventor of the DNS. ANS was designed to meet the needs of top level domain servers. ... Nominum headquarters in Redwood City Nominum, Inc. ... Dr. Paul V. Mockapetris proposed a Domain Name System (DNS) architecture in 1983 in RFCs 882 and 883 while at the Information Sciences Institute (ISI) of the University of Southern California. ... A top-level domain (TLD) is the last part of which Internet domain names consist of. ...

CNS

A high-performance commercial recursive caching server from Nominum, intended as a secure alternative to BIND for enterprises. The Caching Name Server (CNS) is high-end commercial caching-only DNS server software product from Nominum, a company founded by Paul Mockapetris, the inventor of the DNS. ANS was designed to meet the needs of top level domain servers. ... Nominum headquarters in Redwood City Nominum, Inc. ...

Posadis

An open source DNS server, written in C++, featuring Dynamic DNS update support. In computing, Posadis is a GPL-licensed DNS server for Microsoft Windows and Unix that uses a zone file format that is compatible with BIND zone files. ... Dynamic DNS is a system which allows the domain name data held in a name server to be updated in real time. ...

Secure64 DNS

A security-hardened commercial DNS appliance, deployed on a proprietary 64-bit operating system running on Intel Itanium hardware. Secure64 Software Corporation is a software development company headquartered in Greenwood Village, CO, USA, building secure, self-protecting, high performing server applications. ... 2007 Itanium logo Itanium is the brand name for 64-bit Intel microprocessors that implement the Intel Itanium architecture (formerly called IA-64). ...

Unbound

Unbound is a validating, recursive and caching DNS server designed for high-performance. It was released May 20, 2008 (version 1.0.0) in form of open source software licensed under the BSD license by NLnet Labs, Verisign Inc., Nominet, and Kirei. Unbound is a validating, recursive, and caching DNS server software product from NLnet Labs, VeriSign Inc. ...

Features

Some DNS features are relevant only to recursive servers, or to authoritative servers. As a result, a feature matrix such as the one in this article cannot by itself represent the effectiveness or maturity of a given implementation.

Another important qualifier is the server architecture. Some DNS servers provide support for both server roles in a single, "monolithic" program. Others are divided into smaller programs, each implementing a subsystem of the server. As in the classic Computer Science microkernel debate, the importance and utility of this distinction is hotly debated. The feature matrix in this article does not discuss whether DNS features are provided in a single program or several, so long as those features are provided with the base server package and not with third-party add-on software. Graphical overview of a microkernel A microkernel is a minimal computer operating system kernel providing only basic operating system services (system calls), while other services (commonly provided by kernels) are provided by user-space programs called servers. ...

Explanation of Features

Authoritative

A major category of DNS server functionality, see above.

Recursive

A major category of DNS server functionality, see above.

Recursion Access Control

Servers with this feature provide control over which hosts are permitted DNS recursive lookups. This is useful for load balancing and service protection.

Slave Mode

Authoritative servers can publish content that originates from primary data storage (such as zone files or databases connected to business administration processes)--such servers are also called 'master' servers--or can be slave or secondary servers, republishing content fetched from and synchronized with such master servers. Servers with a "slave mode" feature have a built-in capability to retrieve and republish content from other servers. This is typically, though not always, provided using the AXFR DNS protocol.

Caching

Servers with this feature provide recursive services for applications, and cache the results so that future requests for the same name can be answered quickly, without a full DNS lookup. This is an important performance feature, as it significantly reduces the latency of DNS requests.

DNSSEC

Servers with this feature implement some variant of the DNSSEC protocols. They may publish names with resource record signatures (providing a "secure authority service"), and may validate those signatures during recursive lookups (providing a "secure resolver"). DNSSEC is not widespread, and has not been adopted by the most popular sites on the Internet. Its value and feasibility has been the subject of debate. However, the presence of DNSSEC features is a notable characteristic of a DNS server.

TSIG

Servers with this feature typically provide DNSSEC services. In addition, they support the TSIG protocol, which allows DNS clients to establish a secure session with the server to publish Dynamic DNS records or to request secure DNS lookups without incurring the cost and complexity of full DNSSEC support.

IPv6

Servers with this feature are capable of publishing or handling DNS records that refer to IPv6 addresses. In addition to be fully IPv6 capable they must implement IPv6 transport protocol for queries and zone transfers in slave/master relationships and forwarder functions.

LOC Record

Servers with this feature are capable of publishing or handling DNS LOC records, which contain geographic information about DNS names.

Wildcard

Servers with this feature can publish information for wildcard records, which provide data about DNS names in DNS zones that are not specifically listed in the zone.

Split horizon

Servers with the split-horizon DNS feature can give different answers depending on what IP/subnet the query is coming from.

AXFR is a type of DNS query used to retrieve an entire zone from a nameserver. ... The Domain Name System Security Extensions (DNSSEC) are a suite of IETF specifications for securing certain kinds of information provided by the Domain Name System (DNS) as used on Internet Protocol (IP) networks. ... TSIG (Transaction SIGnature) is a computer networking protocol. ... Dynamic DNS is a system which allows the domain name data held in a name server to be updated in real time. ... Internet Protocol version 6 (IPv6) is a network layer for packet-switched internetworks. ... The LOC record (RFC1876) is a means for expressing location information in the Domain Name System. ... A wildcard DNS record is a record in a DNS zone file that will match all requests for non-existent domain names, i. ... In computer networking, split-horizon domain name service (DNS) is the facility to provide access to different sets of DNS information to network clients, selected by, usually, the source address of the DNS request. ...

Feature Matrix

1. ^  A BIND configuration module is available for Webmin in many Linux distributions.
2. ^  djbdns provides facilities to transfer zones; after completing the zone transfer, djbdns can act as an authoritative server for that zone. Consult the axfr-get documentation for further information.
3. ^  This is not the same as views in bind. But it is a solution with comparable capabilities. See: section of tinydns-data.
4. ^  MaraDNS cannot directly provide slave support. Instead, a zone transfer is needed, after which MaraDNS will act as an authoritative server for that zone. See DNS Slave for further information.
5. ^  DNSSEC functionality must be manually activated in the registry. It is not enabled by default, and is only available in Windows Server 2003. Additionally, the DNSSEC support is sufficient to act as a slave/secondary server for a signed zone, but not sufficient to create a signed zone (lack of key generation and signing utilities).
6. ^  IPv6 functionality in the Microsoft DNS server is only available on Windows Server 2003, and only if enabled from the command line.
7. ^  Simple DNS Plus does not have "views" in the same way as BIND, but has a "NAT IP Alias" feature which allows host records to resolve to different IP addresses depending on where the DNS request comes from.
8. ^  It is possible to support the concept of views in PowerDNS by either running two copies of PowerDNS in parallel (on the same machine), or by writing a custom backend which serves different data based on the client who is querying. See here for the original answer regarding this topic by the author of PowerDNS.
9. ^  IPv6 support in PowerDNS is incomplete. Zone transfers in master/slave replication are only functional with IPv4 transport.

In computer security, an access control list (ACL) is a list of permissions attached to an object. ... The Domain Name System Security Extensions (DNSSEC) are a suite of IETF specifications for securing certain kinds of information provided by the Domain Name System (DNS) as used on Internet Protocol (IP) networks. ... TSIG (Transaction SIGnature) is a computer networking protocol. ... Internet Protocol version 6 (IPv6) is a network layer for packet-switched internetworks. ... BIND (Berkeley Internet Name Domain, previously: Berkeley Internet Name Daemon) is the most commonly used DNS server on the Internet, especially on Unix-like systems, where it is a de facto standard. ... The DNS support in Microsoft Windows NT (and thus its derivatives Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003) comprises two clients and a server. ... djbdns is a simple and secure DNS implementation created by Daniel J. Bernstein because he was fed up with repeated BIND security holes. ... Dnsmasq is a lightweight, easy to configure, DNS forwarder and DHCP server. ... Simple DNS Plus is a popular DNS server software product that runs on the Windows operating system running on x86 and x64 hardware. ... In Internet computing, NSD (for name server daemon) is a server program for the Domain Name System. ... PowerDNS is a versatile DNS server, written in C++ and licensed under the GPL. It runs on most Unix derivatives and on Microsoft Windows. ... MaraDNS is a security-aware Domain Name System (DNS) implementation. ... The Authoritative Name Server (ANS) is high-end commercial authority-only DNS server software product from Nominum, a company founded by Paul Mockapetris, the inventor of the DNS. ANS was designed to meet the needs of top level domain servers. ... The Caching Name Server (CNS) is high-end commercial caching-only DNS server software product from Nominum, a company founded by Paul Mockapetris, the inventor of the DNS. ANS was designed to meet the needs of top level domain servers. ... In computing, Posadis is a GPL-licensed DNS server for Microsoft Windows and Unix that uses a zone file format that is compatible with BIND zone files. ... Secure64 Software Corporation is a software development company headquartered in Greenwood Village, CO, USA, building secure, self-protecting, high performing server applications. ... Unbound is a validating, recursive, and caching DNS server software product from NLnet Labs, VeriSign Inc. ... The Domain Name System Security Extensions (DNSSEC) are a suite of IETF specifications for securing certain kinds of information provided by the Domain Name System (DNS) as used on Internet Protocol (IP) networks. ... Internet Protocol version 6 (IPv6) is a network layer for packet-switched internetworks. ... PowerDNS is a versatile DNS server, written in C++ and licensed under the GPL. It runs on most Unix derivatives and on Microsoft Windows. ... PowerDNS is a versatile DNS server, written in C++ and licensed under the GPL. It runs on most Unix derivatives and on Microsoft Windows. ... PowerDNS is a versatile DNS server, written in C++ and licensed under the GPL. It runs on most Unix derivatives and on Microsoft Windows. ...

Platforms

The operating systems or virtual machines the DNS server are designed to run on without emulation; there are several possibilities: An operating system (OS) is a software that manages computer resources and provides programmers with an interface used to access those resources. ... In computer science, a virtual machine is software that creates a virtualized environment between the computer platform and its operating system, so that the end user can operate software on an abstract machine. ... This article is about emulation in computer science. ...

• No indicates that it does not exist or was never released.

• Partial indicates that while it works, the server lacks important functionality compared to versions for other OSs; it is still being developed however.

• Beta indicates that while a version is fully functional and has been released, it is still in development (e.g. for stability).

• Yes indicates that it has been officially released in a fully functional, stable version.

• Included indicates that the server comes pre-packaged with or has been integrated into the operating system.

• Software Appliance indicates that the server has the operating system built in as Just enough operating system (JeOS)

Please note that the list is not exhaustive, but rather reflects the most common platforms today. JeOS is the abbreviation (pronounced juice) for the concept of Just Enough Operating System as it applies to a software appliance. ...

1. ^  BIND is available for Windows NT-based systems (including Windows 2000, XP, and Server 2003) in a port known as ntbind.
2. ^  The functionality available with the Microsoft DNS server varies depending on the version of the underlying operating system; such as most Windows Server components, it is upgraded only with the rest of the operating system. Certain functionality, such as DNSSEC and IPv6 support, is only available in the Windows Server 2000-2003 version. Windows 2000 Server includes TSIG support. The Microsoft DNS Server is not available on Windows client operating systems such as Windows XP.
3. ^  Most well-known Linux distributions come with BIND either installed as default or with the option of only installing a caching-only configuration. Distributions installed as a typical server configuration will have the former and distributions installed as a desktop or workstation configuration will have the latter.
4. ^  Secure64 DNS runs exclusively on SourceT, a micro operating system developed by Secure64.

BSD redirects here; for other uses see BSD (disambiguation). ... Solaris is a computer operating system developed by Sun Microsystems. ... This article is about operating systems that use the Linux kernel. ... Mac OS X (pronounced )[3] is a line of graphical operating systems developed, marketed, and sold by Apple Inc, the latest of which is pre-loaded on all currently shipping Macintosh computers. ... Windows redirects here. ... BIND (Berkeley Internet Name Domain, previously: Berkeley Internet Name Daemon) is the most commonly used DNS server on the Internet, especially on Unix-like systems, where it is a de facto standard. ... The DNS support in Microsoft Windows NT (and thus its derivatives Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003) comprises two clients and a server. ... djbdns is a simple and secure DNS implementation created by Daniel J. Bernstein because he was fed up with repeated BIND security holes. ... Dnsmasq is a lightweight, easy to configure, DNS forwarder and DHCP server. ... Simple DNS Plus is a popular DNS server software product that runs on the Windows operating system running on x86 and x64 hardware. ... In Internet computing, NSD (for name server daemon) is a server program for the Domain Name System. ... PowerDNS is a versatile DNS server, written in C++ and licensed under the GPL. It runs on most Unix derivatives and on Microsoft Windows. ... MaraDNS is a security-aware Domain Name System (DNS) implementation. ... The Authoritative Name Server (ANS) is high-end commercial authority-only DNS server software product from Nominum, a company founded by Paul Mockapetris, the inventor of the DNS. ANS was designed to meet the needs of top level domain servers. ... The Caching Name Server (CNS) is high-end commercial caching-only DNS server software product from Nominum, a company founded by Paul Mockapetris, the inventor of the DNS. ANS was designed to meet the needs of top level domain servers. ... In computing, Posadis is a GPL-licensed DNS server for Microsoft Windows and Unix that uses a zone file format that is compatible with BIND zone files. ... Secure64 Software Corporation is a software development company headquartered in Greenwood Village, CO, USA, building secure, self-protecting, high performing server applications. ... Unbound is a validating, recursive, and caching DNS server software product from NLnet Labs, VeriSign Inc. ... Windows NT (New Technology) is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. ... Windows 2000 (also referred to as Win2K) is a preemptive, interruptible, graphical and business-oriented operating system designed to work with either uniprocessor or symmetric multi-processor computers. ... Windows XP is a line of operating systems developed by Microsoft for use on personal computers, including home and business desktops, notebook computers, and media centers. ... Windows Server 2003 (also referred to as Win2K3) is a server operating system produced by Microsoft. ... The Domain Name System Security Extensions (DNSSEC) are a suite of IETF specifications for securing certain kinds of information provided by the Domain Name System (DNS) as used on Internet Protocol (IP) networks. ... Internet Protocol version 6 (IPv6) is a network layer for packet-switched internetworks. ... TSIG (Transaction SIGnature) is a computer networking protocol. ... This article is about operating systems that use the Linux kernel. ... A Linux distribution (also called GNU/Linux distribution) is a member of the Linux family of Unix-like software distributions. ... BIND (Berkeley Internet Name Domain, previously: Berkeley Internet Name Daemon) is the most commonly used DNS server on the Internet, especially on Unix-like systems, where it is a de facto standard. ...

Packaging

USD redirects here. ... A software license is a legal agreement which may take the form of a proprietary or gratuitous license as well as a memorandum of contract between a producer and a user of computer software. ... BIND (Berkeley Internet Name Domain, previously: Berkeley Internet Name Daemon) is the most commonly used DNS server on the Internet, especially on Unix-like systems, where it is a de facto standard. ... In January 2004 the projects, assets and staff of Internet Software Consortium were transferred to a new company, Internet Systems Consortium. ... The BSD license is a permissive license and is one of the most widely used free software licenses. ... The DNS support in Microsoft Windows NT (and thus its derivatives Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003) comprises two clients and a server. ... Microsoft Corporation, (NASDAQ: MSFT, HKSE: 4338) is a multinational computer technology corporation with global annual revenue of US$44. ... Windows Server may refer to: Windows 2000 Server, the release based on Windows 2000 Windows Server 2003, the current release of Windows Server Windows Server Longhorn, the upcoming release of Windows Server Windows Home Server, an upcoming server operating system intended for home use Microsoft Servers, a family of servers... A clickwrap agreement (also known as a clickthrough agreement or clickwrap license) is a common type of agreement (often used in connection with software licenses). ... djbdns is a simple and secure DNS implementation created by Daniel J. Bernstein because he was fed up with repeated BIND security holes. ... Daniel Julius Bernstein (sometimes known simply as djb; born October 29, 1971) is a professor at the University of Illinois at Chicago, a mathematician, a cryptologist, and a programmer. ... The public domain comprises the body of all creative works and other knowledge—writing, artwork, music, science, inventions, and others—in which no person or organization has any proprietary interest. ... Dnsmasq is a lightweight, easy to configure, DNS forwarder and DHCP server. ... GPL redirects here. ... Simple DNS Plus is a popular DNS server software product that runs on the Windows operating system running on x86 and x64 hardware. ... A clickwrap agreement (also known as a clickthrough agreement or clickwrap license) is a common type of agreement (often used in connection with software licenses). ... In Internet computing, NSD (for name server daemon) is a server program for the Domain Name System. ... The BSD license is the license agreement that the BSD software (largely, a version of UNIX) is distributed under. ... PowerDNS is a versatile DNS server, written in C++ and licensed under the GPL. It runs on most Unix derivatives and on Microsoft Windows. ... Bert Hubert (born May 12, 1975 in Scheveningen, The Netherlands) is a Dutch open source software developer. ... GPL redirects here. ... MaraDNS is a security-aware Domain Name System (DNS) implementation. ... The BSD license is the license agreement that the BSD software (largely, a version of UNIX) is distributed under. ... The Authoritative Name Server (ANS) is high-end commercial authority-only DNS server software product from Nominum, a company founded by Paul Mockapetris, the inventor of the DNS. ANS was designed to meet the needs of top level domain servers. ... Nominum headquarters in Redwood City Nominum, Inc. ... A clickwrap agreement (also known as a clickthrough agreement or clickwrap license) is a common type of agreement (often used in connection with software licenses). ... The Caching Name Server (CNS) is high-end commercial caching-only DNS server software product from Nominum, a company founded by Paul Mockapetris, the inventor of the DNS. ANS was designed to meet the needs of top level domain servers. ... Nominum headquarters in Redwood City Nominum, Inc. ... A clickwrap agreement (also known as a clickthrough agreement or clickwrap license) is a common type of agreement (often used in connection with software licenses). ... Secure64 Software Corporation is a software development company headquartered in Greenwood Village, CO, USA, building secure, self-protecting, high performing server applications. ... Secure64 Software Corporation is a software development company headquartered in Greenwood Village, CO, USA, building secure, self-protecting, high performing server applications. ... A clickwrap agreement (also known as a clickthrough agreement or clickwrap license) is a common type of agreement (often used in connection with software licenses). ... In computing, Posadis is a GPL-licensed DNS server for Microsoft Windows and Unix that uses a zone file format that is compatible with BIND zone files. ... GPL redirects here. ... Unbound is a validating, recursive, and caching DNS server software product from NLnet Labs, VeriSign Inc. ... The BSD license is a permissive license and is one of the most widely used free software licenses. ...

Also See

• DNS management software

DNS management software is software that runs Domain Name System server clusters. ...

External links

• Don Moore's May 2004 DNS Internet survey
• The Measurement Factory DNS Survey Summary: April & June 2005
• Beehive/CoDoNS DNS Survey: July 2004
• ITU ccTLD DNS Survey