|Developer(s)||Daniel J. Bernstein|
|Stable release||1.05 / February 11, 2001|
The djbdns software package is a DNS implementation created by Daniel J. Bernstein due to his frustrations with repeated BIND security holes. A $1000 prize for the first person to find a security hole in djbdns was awarded in March 2009 to Matthew Dempsky.
The source code has not been centrally managed since 2001 and was released into the public domain in 2007. As of March 2009, there are three forks, one of which is dbndns, the fork of the Debian Project, and more than a dozen patches to address shortcomings.
The main djbdns components
The djbdns software consists of server, client, and some miscellaneous configuration tools.
- dnscache — the DNS resolver and cache.
- tinydns — a database-driven DNS server.
- walldns — a "reverse DNS wall", providing IP address-to-domain name lookup only.
- rbldns — a server designed for DNS blacklisting service.
- pickdns — a database-driven server that chooses from matching records depending on the requestor's location. (This feature is now a standard part of tinydns.)
- axfrdns — a zone transfer server.
- axfr-get — a zone-transfer client.
- dnsip — simple address from name lookup.
- dnsipq — address from name lookup with rewriting rules.
- dnsname — simple name from address lookup.
- dnstxt — simple text record from name lookup.
- dnsmx — mail exchanger lookup.
- dnsfilter — looks up names for addresses read from stdin, in parallel.
- dnsqr — recursive general record lookup.
- dnsq — non-recursive general record lookup, useful for debugging.
- dnstrace (and dnstracesort) — comprehensive testing of the chains of authority over dns servers and their names.
In djbdns, different features and services, such as AXFR zone transfers, are split off into separate programs. Zone file parsing, caching, and recursive resolving are also implemented as separate programs. The result of these design decisions is a dramatic reduction in code size and complexity of the daemon program that answers lookup requests. Daniel J. Bernstein (and many others)[who?] feel that this is true to the spirit of the Unix operating system, and makes security verification much simpler.
On December 28, 2007, Bernstein released djbdns into the public domain. Until that day, the package was distributed as license-free software, which prevented the distribution of modified versions of djbdns which was in conflict with the principles of Open source software which made the inclusion in many Linux distributions infeasible if not impossible.
- "The djbdns security guarantee". Retrieved 2008-09-02.
- "The djbdns prize claimed". Retrieved 2009-03-04.
- Moore, Don (2004). "DNS server survey". Retrieved 2005-01-06.
- "Multiple DNS implementations vulnerable to cache poisoning". Retrieved 2008-08-05.
- "An Astonishing Collaboration". Retrieved 2008-08-05.
- Day, Kevin (2009). "Rapid DNS Poisoning in djbdns". Retrieved 2009-02-23.
- "djbdns is placed in the public domain".
- "Detailed overview of DNS server software by Rick Moen". Retrieved 2009-07-13.
- "Frequently asked questions from distributors". Retrieved 2007-12-31.
- djbdns official homepage
- A guide to djbdns
- The djbdns section of FAQTS
- Unofficial website
- A djbdns guide and tutorial with addon
- Jonathan de Boyne Pollard. "Some of what is said about djbdns is wrong.". Frequently Given Answers. — Jonathan de Boyne Pollard's debunking of several myths relating to djbdns
- Jonathan de Boyne Pollard. "The known problems with Dan Bernstein's djbdns". Frequently Given Answers. — Jonathan de Boyne Pollard's list of the several known problems in djbdns
- Supporting newer record formats through generic records.
- LWN (Linux weekly news) looks at djbdns