Unbound is a production-grade, modular, recursive DNS resolver with extensive DNSSEC validation, caching, and policy enforcement. It functions as a system daemon that iteratively resolves DNS queries from root servers or forwards to upstream resolvers, caches results in multi-layered caches (message, RRset, infrastructure), and validates responses according to DNSSEC. The daemon supports multiple transport protocols: UDP, TCP, TLS (DoT), HTTPS (DoH), and QUIC (DoQ), as well as experimental DNSCrypt encryption. It includes a modular processing pipeline where the iterator, validator, response-IP modification (respip), DNS64 synthesis, and other modules are composable at startup. An embedded library (libunbound) provides a public C and Python API for synchronous and asynchronous DNS lookups, enabling integration into other applications.
The miekg/dns repository is a Go library implementing the DNS protocol, providing core functionality for building DNS clients, servers, and tools. It handles DNS message packing/unpacking, supports all standard Resource Record types, includes DNSSEC signing/validation, zone file parsing, dynamic updates, TSIG authentication, and EDNS0 options. The library follows a modular design with separate packages for client, server, message handling, and specialized DNS features, adhering closely to RFC standards. Architecturally, it centers around the dns.Msg struct for DNS messages and the dns.RR interface for resource records. Key entry points include dns.Client for queries, dns.Server with dns.ServeMux for request routing, and dns.ZoneParser for zone file processing. The library is used by major projects like CoreDNS and Geodns, demonstrating its reliability and standards compliance. While the 1.x line is in maintenance-only mode (with performance-focused v2 development elsewhere), it remains actively maintained for critical fixes and continues to implement new DNS standards such as SVCB/HTTPS records. The codebase exhibits strong engineering practices: extensive unit tests, fuzz targets, benchmarks, and clear separation of concerns. Generated code minimizes boilerplate for RR handling, and patterns like the ServeMux mirror familiar Go idioms. Dependencies are limited to the Go standard library, reducing external risk. Recent commits indicate ongoing maintenance, and the library's widespread adoption confirms its production readiness.
The erldns repository is an Erlang/OTP-based authoritative DNS server that processes DNS queries through a modular pipeline architecture. It loads zone data from JSON or standard zone files, provides DNSSEC validation and signing, and includes features like query throttling, EDNS0 processing, and an HTTP-based Admin API for runtime zone management and monitoring. The system is built using OTP supervision trees, with separate supervisors for listeners, pipeline workers, and zone loading. Key architectural strengths include a reusable pipeline pattern for extensible query processing, a worker pool for asynchronous operations, a segmented cache abstraction for high-concurrency scenarios, and admission control mechanisms using CoDel and Cubic algorithms. The Admin API follows a middleware pattern allowing custom extensions, and the zone loading subsystem supports pluggable codecs for custom record types. The codebase demonstrates strong engineering practices with comprehensive testing, dependency management, and observability via telemetry.