cloudDNS

cloudDNS

cloudDNS is a high-performance, authoritative, and recursive DNS server built from scratch in Go. Designed for modern cloud environments, it implements strict RFC standards with a focus on security, scalability, and control.

Key Features

DNSSEC (DNS Security Extensions)

• Signing: Automated KSK/ZSK generation, rotation, and zone signing with Double-Signature rollover for zero-downtime key rotation.
• Validation: Response validation with ECDSA P-256, AD bit support, and RFC 8914 Extended DNS Error (EDE) codes for debugging.
• Modes: Three validation modes - disabled, ad-bit-only, or strict (SERVFAIL on invalid).
• NSEC/NSEC3: Authenticated denial of existence for secure proof of non-existence.
• Documentation: See docs/dnssec.md for full details.

Core Protocol & Performance

• Manual Wire Format (RFC 1035): Custom binary parser and serializer for maximum control over DNS packets.
• Dual-Stack Transport: Parallel high-performance UDP listener pool and framed TCP handlers.
• Caching Strategy: Sharded, two-layer caching architecture:
  • L1: In-memory, thread-safe sharded cache with Transaction ID rewriting.
  • L2: Distributed Redis cache for shared state.
  • Global Invalidation: Real-time cross-node cache invalidation via Redis Pub/Sub.
• Worker Pool: Configurable worker pool pattern to handle high-concurrency traffic bursts.

High Availability & Anycast

• Anycast BGP Integration: Native BGP support (GoBGP v4) for sub-second failover orchestration.
• Automated VIP Management: Built-in management of local interface IP aliases for Anycast VIPs.
• Health-Aware Routing: Real-time route announcement and withdrawal based on service health.

Advanced DNS Standards

• Smart Engine (GSLB): Active health monitoring (HTTP/TCP) for endpoints with automated failover and fallback resolution.
• Dynamic Updates (RFC 2136): Secure, atomic updates to zone records at runtime.
• Incremental Zone Transfer (IXFR - RFC 1995): Efficient replication that transfers only changes, not the entire zone.
• DNS NOTIFY (RFC 1996): Real-time notification to secondary servers upon zone changes.
• DNS over HTTPS (DoH - RFC 8484): Secure DNS queries via HTTP/2, supporting both GET (base64url) and POST (binary).
• DNS over QUIC (DoQ - RFC 9250): Low-latency DNS over QUIC with 0-RTT connection establishment.
• HTTPS Records (RFC 9460): Service binding hints for HTTP-aware clients with ECH support.
• EDNS(0) & Truncation (RFC 6891): Extended payload support with automatic TCP fallback.
• TSIG (RFC 2845): HMAC-authenticated transactions for secure updates and transfers.
• CHAOS Class Support: Node identity resolution (id.server., hostname.bind.) for NSID-ready deployments.

Architecture & Management

• Hexagonal Architecture: Clean separation of concerns (Domain -> Ports -> Adapters).
• PostgreSQL Backend: Robust persistence for zones, records, and keys.
• RESTful API: Full CRUD API for managing zones, records, and viewing audit logs.
• Split-Horizon DNS: Intelligent resolution providing different answers based on client source IP (CIDR).
• API Authentication & RBAC: Secure RESTful API with SHA-256 hashed API keys and role-based permissions (admin, reader).
• Rate Limiting: Token-bucket based DoS protection per client IP.

Architecture

cloudDNS follows a strict Hexagonal (Ports & Adapters) architecture:

• Core (Domain): Pure business logic (DNS packet rules, Zone logic). No external dependencies.
• Ports: Interfaces defining how the core interacts with the outside world (DNSRepository, DNSService, RoutingEngine).
• Adapters:
  • Primary (Driving): DNS Server (UDP/TCP/DoH), REST API (HTTP).
  • Secondary (Driven): PostgreSQL Repository, Redis Cache, BGP Engine.

Getting Started

Prerequisites

• Go 1.24+
• PostgreSQL 15+
• Redis 7+ (Optional, for distributed caching)

Installation

git clone https://github.com/poyrazK/cloudDNS.git
cd cloudDNS
go mod download

Configuration

The server is configured via environment variables:

Running the Server

# Export necessary variables
export DATABASE_URL="postgres://user:pass@localhost:5432/clouddns?sslmode=disable"

# Run the server
go run cmd/clouddns/main.go

API Key Management

cloudDNS uses API keys for managing zones and records. You can generate a bootstrap admin key using the apikey tool:

# Create an admin key for a tenant
go run cmd/apikey/main.go create -tenant "my-org" -role "admin" -name "Production Key"

# List keys for a tenant
go run cmd/apikey/main.go list -tenant "my-org"

All API requests must include the Authorization: Bearer <key> header.

Testing

cloudDNS maintains a high standard of code quality with 84%+ test coverage.

# Run all tests
go test ./...

# Run benchmark suite
go test -bench=. ./cmd/bench/...

License

This project is licensed under the MIT License - see the LICENSE file for details.