← First Pair Library
Next:
DNS from First Principles
DNS from First Principles
Names, Packets, Authority, Recursion, and the Design of rgbdns
Alexy Khrabrov
2026-07-24
1
DNS from First Principles
1.1
Names, Packets, Authority, Recursion, and the Design of rgbdns
Preface
2
The problem DNS solves
2.1
Identity is not location
2.2
Requirements that pull in different directions
2.3
Roles, not just “DNS servers”
3
Names form a delegated tree
3.1
Labels and the root
3.2
Zones are administrative cuts
3.3
Wildcards are synthesis rules
4
Resource records: typed facts with lifetimes
4.1
The common envelope
4.2
Core types
4.3
Additional data is an optimization
5
Messages on the wire
5.1
The twelve-byte header
5.2
Name compression
5.3
Errors are protocol results
6
UDP, TCP, EDNS, and truncation
6.1
Why there are two transports
6.2
Truncation must preserve a valid message
7
Authority: answering from owned facts
7.1
Finding the closest relevant authority
7.2
tinydns data as a source language
7.3
CDB: compile once, read predictably
8
Recursion: discovering an answer
8.1
Iteration from the root
8.2
The cache is part of correctness
8.3
Forward zones and djbdns roots
9
DNSSEC: authenticating the chain
9.1
What ordinary DNS cannot prove
9.2
rgbdns validation policy
10
Zone transfer and secondary service
10.1
AXFR is a stream, not a giant datagram
11
The rgbdns program family
11.1
One suite, small purposes
11.2
Specialized responders
12
Client behavior and diagnostics
12.1
A query is more than sending bytes
12.2
Practical checks
13
Security engineering in rgbdns
13.1
The packet is hostile
13.2
Least privilege and filesystem boundaries
14
Time and logs: TAI64N
14.1
Why a DNS suite contains time tools
15
Running rgbdns under supervision
15.1
The service contract
15.2
Recommendations
15.3
A practical selection rule
16
Operating an authoritative service
16.1
Build, stage, verify, replace
16.2
Observe the right signals
17
Testing DNS software
17.1
Layers of evidence
17.2
Adversarial cases worth keeping
17.3
Conformance as an executable specification
17.4
Hardening found by conformance work
17.5
Benchmarks and evidence-driven optimization
18
Reading the rgbdns source
18.1
A path through the code
18.2
Design patterns to carry elsewhere
19
Where DNS ends
20
Appendix A: Configuration quick reference
21
Appendix B: Further reading