[WIP] High-performance DNS server with rule matching/DoT/DoH functionality built-in.
Your DNS supercharged! A high-performance DNS server with freestyle routing scheme support, DoT/DoH functionalities built-in.
中文版
Imagine you are living in a county where your ISP constantly hijacks your DNS requests and responses.
There are solutions like DNS-over-HTTPS or DNS-over-TLS. You can use software like CoreDNS or stubby, but they don't simply solve the problem as only using DoT/DoH is slower in most cases.
In order to concurrently query and not be trapped by ISP, you then try to have software like SmartDNS or Overture to offer yourself some flexibility on dispatching DNS requests. However, everyone has their own story, those preset rules don't fit all at once.
What's even worse is that you probably want to have DNS-level ad-blocking functionality, do you really want to add another layer of AdGuard Home? Can you do all of these at once?
Indeed, you can.
dcompassgives you full-freedom in matching and handling every DNS requests via custom routing table, and also finely-grained control over usages of upstreams.
In short,
dcompassenables you to write your own logic of how your DNS server should behave, as simple as possible.
Breaking changes happened as new routing scheme has been adopted, see configuration section below to adapt.
dcompass -c path/to/config.json # Or YAML
Or you can simply run
dcompassfrom the folder where your configuration file named
config.ymlresides.
dcompass -c path/to/config.json -v
You can download binaries at release page. 1. GitHub Action build is set up for targets
x86_64-unknown-linux-musl,
armv7-unknown-linux-musleabihf,
armv5te-unknown-linux-musleabi,
x86_64-pc-windows-gnu,
x86_64-apple-darwin,
aarch64-unknown-linux-musland more. Typically, arm users should use binaries corresponding to their architecture. In particular, Raspberry Pi users can try all three (
armv7-unknown-linux-musleabihf,
armv5te-unknown-linux-musleabi,
aarch64-unknown-linux-musl). Each of the targets has three different versions, namely
full,
cn,
min.
fullversion includes the full maxmind GeoIP2 database, while
cnincludes GeoIP2-CN database only.
minincludes no database at all. 2. NixOS package is available at this repo as a flake. Also, for NixOS users, a NixOS modules is provided with systemd services and easy-to-setup interfaces in the same repository where package is provided.
└───packages ├───aarch64-linux │ ├───dcompass-cn: package 'dcompass-cn-git' │ └───dcompass-maxmind: package 'dcompass-maxmind-git' ├───i686-linux │ ├───dcompass-cn: package 'dcompass-cn-git' │ └───dcompass-maxmind: package 'dcompass-maxmind-git' ├───x86_64-darwin │ ├───dcompass-cn: package 'dcompass-cn-git' │ └───dcompass-maxmind: package 'dcompass-maxmind-git' └───x86_64-linux ├───dcompass-cn: package 'dcompass-cn-git' └───dcompass-maxmind: package 'dcompass-maxmind-git'cache is available at cachix, with public key
dcompass.cachix.org-1:uajJEJ1U9uy/y260jBIGgDwlyLqfL1sD5yaV/uWVlbk=(
outputs.publicKey).
See example.yaml
Configuration file contains different fields: -
cache_size: Size of the DNS cache system. Larger size implies higher cache capacity (use LRU algorithm as the backend). -
verbosity: Log level filter. Possible values are
trace,
debug,
info,
warn,
error,
off. -
address: The address to bind on. -
table: A routing table composed of
ruleblocks. The table cannot be empty and should contains a single rule named with
start. Each rule contains
tag,
if,
then, and
else. Latter two of which are of the form
(action1, action 2, ... , next)(you can omit the action and write ONLY
(next)), which means take the actions first and goto the next rule with the tag specified. -
upstreams: A set of upstreams.
timeoutis the time in seconds to timeout, which takes no effect on method
Hybrid(default to 5).
tagis the name of the upstream.
methodsis the method for each upstream.
Different actions: -
disable: Set response with a SOA message to curb further query. It is often used accompanied with
qtypematcher to disable certain types of queries. -
query(tag): Send query via upstream with specified tag.
Different matchers: (More matchers to come) -
any: Matches anything. -
domain(list of file paths): Matches domain in specified domain lists -
qtype(list of record types): Matches record type specified. -
geoip(codes: list of country codes, path: optional path to the mmdb database file): If there is one or more
Aor
AAAArecords at the current state and the first of which has got a country code in the list specified, then it matches, otherwise it always doesn't match. -
ipcidr(list of files that contain CIDR entries): Same as
geoip, but it instead matches on CIDR.
Different querying methods: -
https: DNS over HTTPS querying methods.
no_snimeans don't send SNI (useful to counter censorship).
nameis the TLS certification name of the remote server.
addris the remote server address. -
tls: DNS over TLS querying methods.
no_snimeans don't send SNI (useful to counter censorship).
nameis the TLS certification name of the remote server.
addris the remote server address. -
udp: Typical UDP querying method.
addris the remote server address. -
hybrid: Race multiple upstreams together. the value of which is a set of tags of upstreams. Note, you can include another
hybridinside the set as long as they don't form chain dependencies, which is prohibited and would be detected by
dcompassin advance.
See example.yaml for a pre-configured out-of-box anti-pollution configuration (Only works with
fullor
cnversion, to use with
min, please provide your own database).
Table example of using GeoIP to mitigate pollution
table: - tag: start if: any then: - query: domestic - check_secure - tag: check_secure if: geoip: codes: - CN else: - query: secure - end
Mocked benchmark: ``` noncacheresolve time: [10.624 us 10.650 us 10.679 us] change: -0.9733% -0.0478% +0.8159% No change in performance detected. Found 12 outliers among 100 measurements (12.00%) 1 (1.00%) low mild 6 (6.00%) high mild 5 (5.00%) high severe
cached_resolve time: [10.712 us 10.748 us 10.785 us] change: -5.2060% -4.1827% -3.1967% Performance has improved. Found 10 outliers among 100 measurements (10.00%) 2 (2.00%) low mild 7 (7.00%) high mild 1 (1.00%) high severe ```
Following benchmarks are not mocked, but they are rather based on multiple perfs in wild. Not meant to be accurate for statical purposes. - On
i7-10710U, dnsperf gets out
~760 qpswith
0.12s avg latencyand
0.27% ServFailrate for a test of
15004queries. - As a reference SmartDNS gets
~640 qpsfor the same test on the same hardware.
DoH,
DoT,
TCP, and
UDP.
All three components
dmatcher,
droute,
dcompassare licensed under GPLv3+.
dcompassand
droutewith
geoipfeature gate enabled include GeoLite2 data created by MaxMind, available from https://www.maxmind.com.