# semihalev/sdns

A high-performance, recursive DNS resolver server with DNSSEC support, focused on preserving privacy.

Repository: https://github.com/semihalev/sdns
Canonical: https://ross.abutalabs.com/products/sdns
Homepage: https://sdns.dev
Language: Go
License: MIT
License Family: permissive
Topics: dns, dns-server, dnssec, dns-resolver, edns, dns-over-https, dns-over-tls, resolver, dns-privacy, dns-over-quic
Last push: 2026-09-02T20:50:50+00:00

## Health v2 (maintenance only)
Score: 100/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 100, release rhythm 100, longevity 100
- inputs: {"age_days": 2893, "days_push": 0, "days_rel": 1, "gap_med": 10, "n_releases_24m": 20}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1076, forks 69 (observed 2026-09-03T02:15:17.780052+00:00)

## What it is
SDNS is a high-performance recursive DNS resolver server written in Go, with DNSSEC validation and a privacy-first design supporting DNS-over-TLS, DNS-over-HTTPS, and DNS-over-QUIC. It uses a middleware architecture, ships as a self-contained binary with packages for Linux, macOS, and Docker, and includes a Kubernetes DNS middleware for resolving cluster names.

## Use cases
- run my own recursive dns resolver server
- self-host a privacy-focused dns server
- validate dnssec on dns queries
- encrypt dns queries with dns-over-https, dns-over-tls, or dns-over-quic
- stop my isp from tracking or hijacking dns lookups
- resolve kubernetes service and pod names with a custom resolver
- fast caching dns resolver for a home or office network

## When to choose
- You need a full recursive resolver with DNSSEC validation rather than a simple forwarding cache
- Privacy matters: you want encrypted upstream queries and minimal data exposure to third-party resolvers
- You want a lightweight single Go binary that deploys easily via Docker, brew, snap, or prebuilt binaries
- You run Kubernetes and want cluster-internal DNS names served through your own resolver middleware

## When to avoid
- You only need a minimal DNS forwarder for a small LAN, where dnsmasq is simpler
- You need an authoritative nameserver to host your own public zones; SDNS is a recursive resolver
- You want a point-and-click web UI with ad-blocking blocklists out of the box, which Pi-hole or AdGuard Home provide

## Facets
- artifact type: service
- maturity: active
- function: networking, privacy, security, caching, middleware, self-hosted
- domain: networking, privacy, security, self-hosted
- platform: windows, cross-platform, self-hosted, go, cli
- tags: dns-resolver, dns-server, dnssec, dns-over-https, dns-over-tls, dns-over-quic, recursive-resolver, edns, privacy-focused, kubernetes-dns, devops, linux, macos, docker, kubernetes

## Member repositories
- semihalev/sdns (main) score 100

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:17.780052+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:53:38.698731+00:00, confidence not recorded.
  - readme: https://github.com/semihalev/sdns (fetched 2026-09-03T02:15:17.780052+00:00, sha fd045bd4d415)
  - homepage: https://sdns.dev (fetched 2026-08-29T12:55:26.695680+00:00, sha a75ab321796b)
  - site_page: https://sdns.dev/middleware/kubernetes (fetched 2026-08-29T12:55:26.705687+00:00, sha 8c6957039c48)
- Data as of 2026-08-30T08:39:29.467469+00:00.