.png)
12 hours ago
1
DNSao is a high-performance multi-upstream DNS forwarder
- DNS Sinkhole: blocks domains based on lists, acting as a DNS sinkhole, preventing access to unwanted content, invasive advertising, and hindering trackers
- DNS over TLS and DNS over HTTPS Support: performs queries to upstream servers using traditional UDP, DoT and DoH, ensuring greater privacy in resolutions
- Parallel Querying to Multiple Upstreams: can be configured to send the same query to multiple upstream servers in parallel and returns the fastest response, reducing browsing latency
- Multiple protocol as server: responds for UDP, TCP and HTTP dns queries, enabling different client setups
- High-Performance Cache: stores responses respecting their original TTL, includes negative caching, and a rewarm (pre-heating) mechanism to keep frequently used entries always available
- DNSSEC-Aware Policies: requests DNSSEC data from upstream resolvers and applies configurable policies (off/simple/rigid) based on the AD flag
- YAML Configuration: all server configuration is centralized in a single .yaml file, easy to version and replicate across multiple instances for high availability
- Local DNS Mapping: allows defining local domain resolutions for specific IPs — ideal for homelabs, self-hosting, and internal networks
- Metrics Dashboard: provides a metrics dashboard to monitor operation and performance
- Low Resource Usage: runs comfortably with 256 MB of RAM, even on older hardware or compact devices
- Free and Open Source: free software, openly maintained on GitHub, allowing unrestricted auditing and use
- Stateless Runtime: does not rely on databases or peripheral systems, enabling fast cold starts
- Low Number of Dependencies: only 5 — dnsjava, logback, javalin, minimal-json, and snakeyaml
Purpose¶
Other DNS software acts as a DNS Sinkhole, or supports multiple DoT upstreams, or performs recursive DNS resolution, but it’s always necessary to combine solutions to achieve a satisfactory level of privacy or speed. DNSao exists to be the only DNS tool your network needs.
All source code is available on the project’s GitHub, including the latest releases and development documentation.
Screenshots¶
Query Summary¶
Graph with queries timeline¶
Upstream distribution¶
Benchmarks¶
DNS benchmarks can be somewhat unfair, because after the innitial burst and all domains are properly cached, it is just an exercise of how fast the cpu can get something from memory and wrap it correctly to return, but some people might find it necessary, so here is a couple of tests using dnsperf and a list of 250 domains.
First on in a LXC running with a single core of a recent cpu (i5-12400), where 10000 queries per second results in a perfect score:
And this one in a raspberry pi 3, with the same domains.txt list. When reaching 100 queries per second, it starts to show it's limits:
