rgbdns deliberately exposes separate commands:
| Command family | Purpose |
|---|---|
tinydns, tinydns-data,
tinydns-get, tinydns-edit |
authoritative service and data maintenance |
dnscache |
validating recursive resolver and cache |
axfrdns, axfr-get |
zone transfer server and client |
rbldns, rbldns-data |
address-prefix blocklist DNS |
pickdns, pickdns-data |
location-aware address selection |
walldns |
synthetic address/reverse answers |
dnsq, dnsqr, dnsip*,
dnsname, dnsmx, dnstxt |
queries and diagnostics |
dnsfilter, dnstrace,
random-ip |
stream lookup, delegation tracing, testing |
*-conf |
service-directory generation |
setuidgid, multilog, tai64n,
tai64nlocal |
process and logging support |
This composition makes privilege and failure boundaries visible. A compiler can run with write access to data while the server runs read-only. A recursive cache can be restarted without touching authority. Diagnostic clients reuse the packet and client libraries rather than embedding daemon behavior.
rbldns treats the labels before a configured suffix as a
numeric address, finds the most-specific matching IPv4 prefix in a
compiled database, and returns configured A/TXT data. Parsing caps the
number of numeric labels and validates networks before compilation.
pickdns maps client prefixes to two-byte locations and
selects address sets for that location. It shuffles eligible addresses
with operating-system randomness. Location-aware answers are a policy
feature; clients behind shared resolvers may appear at the resolver’s
address, a limitation operators must understand.
walldns synthesizes narrowly defined forward and reverse
answers without a zone database. These specialized services run through
src/special.rs, which provides shared bounded UDP/TCP
serving and passes the peer address to the handler.
The lesson is architectural: once parsing, transport, names, and record models are sound, unusual DNS policies can be small pure response functions rather than new monolithic servers.