GetDNS

GetDNS
Name	GetDNS
Author	NLnet Labs, Paul Hoffman
Developer	NLnet Labs, Paul Wouters, Internet Systems Consortium
Released	2011
Operating system	Unix-like, Microsoft Windows
License	BSD-like

GetDNS

GetDNS is an application programming interface and library designed for modern Domain Name System resolution and name service abstractions. It provides asynchronous, extensible, and DNSSEC-aware name resolution intended to support contemporary protocols, standards, and deployment models. The project interacts with multiple Internet standards and infrastructure actors to offer privacy-preserving and secure DNS query methods.

Overview

GetDNS emerged to address limitations in legacy resolver APIs such as those used by Berkeley Software Distribution, GNU C Library, and Microsoft Windows resolver stacks by offering a programmable, event-driven interface compatible with Event-driven programming, GNU Project, and POSIX environments. The design aligns with standards from the Internet Engineering Task Force, including work from the IETF TRICKLE and IETF DNS PRIVATEDNS-adjacent communities, while interoperating with implementations like BIND and Unbound. It abstracts transport mechanisms (UDP, TCP, DNS over TLS, DNS over HTTPS) and validation services like DNSSEC validation performed by resolvers such as Unbound and Knot Resolver.

Design and Architecture

GetDNS is implemented as a C library that separates the application-facing API from the network and backend components, enabling pluggable backends including stub resolvers and recursive validators such as Unbound, PowerDNS, and Knot Resolver. Its architecture uses asynchronous I/O models akin to libuv and libevent and integrates with event loops from projects like GNOME and systemd. The API exposes contexts that encapsulate configuration for resolution paths, allowing selection between modes that contact authoritative servers directly or defer to recursive servers such as those operated by Google Public DNS, Cloudflare, and Quad9. Certificate and transport negotiation components reference standards developed in IETF QUIC and IETF HTTP working groups when using DNS over HTTPS or DNS over TLS.

Features and Functionality

GetDNS provides features including asynchronous callbacks, synchronous wrappers for blocking environments, and support for multiple transport protocols: UDP and TCP for classic DNS, DNS over TLS for channel security, and DNS over HTTPS for HTTP/2 and HTTP/3 encapsulation. It supports DNSSEC validation and authenticated denial of existence via concepts standardized by IETF DNSOP and leverages trust anchors similar to those distributed by IANA and projects like the DNSSEC Lookaside Validation discussions. The API returns rich metadata with responses, such as resolver processing time and response chain information useful for diagnostic tooling maintained by communities around Wireshark and RIPE NCC.

Implementations and Bindings

The core C implementation has language bindings and wrappers for ecosystems such as Python (programming language), Node.js, Go (programming language), and Rust (programming language), enabling integration with software stacks like Ansible, Kubernetes, and OpenWrt. Packaging and distribution have been handled by operating system projects such as Debian, Fedora, and FreeBSD, while continuous integration and testing often use services and infrastructures maintained by Travis CI and GitHub Actions. Interoperability testing included interactions with authoritative server software like BIND, NSD, and Knot DNS.

Security and Privacy Considerations

GetDNS focuses on confidentiality and integrity of DNS queries by enabling transports standardized by the IETF DPRIVE working group and aligning with privacy recommendations from organizations such as Electronic Frontier Foundation and Internet Society. It supports DNSSEC validation to mitigate cache poisoning attacks documented in historical incidents involving Kaminsky vulnerability disclosures and cooperates with resolvers that implement anti-poisoning mitigations like those in RFC 6056. Privacy-aware features permit use of authenticated encrypted transports to reduce exposure to on-path observers including ISPs and entities studied by EFF and Open Rights Group. Operational deployment must consider trust models involving third-party recursive services such as Google Public DNS and Cloudflare.

History and Development

Initial development began in the early 2010s with contributions from researchers and engineers associated with NLnet, ISC, and independent contributors like Paul Hoffman, and further work has been coordinated through code hosting platforms such as GitHub and discussions on IETF mailing lists. Work on features such as DNS-over-HTTPS support paralleled efforts by Mozilla Foundation, Google, and Cloudflare to standardize encrypted DNS transports. Releases have been packaged by distributions including Debian and Ubuntu and discussed at conferences like USENIX Security Symposium and IETF meetings.

Adoption and Use Cases

GetDNS has been used in applications requiring explicit control over resolution semantics, such as privacy-focused clients developed by Mozilla, network diagnostic tools built by APNIC and RIPE NCC, and embedded systems supported by OpenWrt and Yocto Project. Developers integrate GetDNS into microservice platforms orchestrated by Kubernetes and continuous deployment pipelines relying on Jenkins or GitLab CI. Research projects at institutions like MIT, Stanford University, and UC Berkeley have used GetDNS for experiments in DNS privacy and performance, while commercial adopters include security vendors and cloud providers experimenting with resolvers like Cloudflare and Google Public DNS.

Category:DNS