Knot DNS is a high-performance authoritative-only DNS server | Hacker News Reader

Knot DNS is a high-performance authoritative-only DNS server

labs.nic.cz

24 pointsadulau14 comments

(You have to click again on English at the top to get this site in English)

Very interesting that "secure" is not listed as one of the key features, and that "security" is not listed as one of the goals.

Yes, but at the same time, if this is the one server used to serve the .cz. root domain, I suppose it is part of the implicit features.

By the way, direct link to the project website: http://www.knot-dns.cz/

Then this will be the first time in history that software has been written specifically to be secure and this feature has not been trumpeted :)

> if this is the one server used to serve the .cz. root domain, I suppose it is part of the implicit features.

From the README:

> Here is a list of the most notable features that are not supported in the current version of Knot.

> * Root zone support

Implementing DNSSEC is an indication that some consideration was put toward security. I wouldn't discount this as being insecure just because it's not mentioned on the short list of goals.

Therefore, it's insecure by design? ;-)

I'm wondering how good the IPv6 support is.

I wonder how does it compare to NSD?

http://www.nlnetlabs.nl/projects/nsd/

I got the following answer via Twitter (https://twitter.com/#!/bortzmeyer/status/132090094067785728) "@adulau Knot is faster, according to the benchmarks made by its authors. But NSD is production-ready and Knot is alpha (or less than that)."

That was my thought. Wanting to avoid bind monoculture, I've deployed nsd/unbound into production in several places. Good, solid products.

I'm glad to see a yet another player in this application space. Now, we have two mature options (MaraDNS and NSD/Unbound) and Knot as potential alternatives to BIND.

Why is this needed over existing authoritative dns servers like djbdns or nsd?

Variety is a good thing: drives innovation, pushes change, keeps incumbents from self-satisfying lethargy.

While that's accurate, it's a truism that adds little to this discussion. Perhaps someone can explain the specific, concrete reasons why this solves a problem existing implementations do not.

Found the English page, now ... where's the download link?

git clone git://git.nic.cz/knot-dns.git

Reply on news.ycombinator.com