DNS Infrastructure

For programmatic DNS (Cloudflare API / Route 53) see DNS & Domain APIs. This page covers running your own DNS infrastructure.

Authoritative DNS servers

• ★ PowerDNS — modular auth + recursor; backends in MySQL / Postgres / LDAP. The default for self-host authoritative.
• ★ Knot DNS — modern, fast authoritative; CZ.NIC.
• NSD (NLnet Labs) — minimalist authoritative; pairs with Unbound.
• BIND — venerable; what the rest of the internet has run on for decades.
• Bun-style DNS options — niche.

Recursive / resolving

• ★ Unbound (NLnet Labs) — fast, lightweight recursor; the default.
• dnsdist (PowerDNS) — DNS load balancer + DDoS shield.
• BIND — also does recursion; large; less recommended for new setups.

Local network DNS / ad blocking

• ★ Pi-hole — DNS sinkhole + ad blocker; web UI; the home network classic.
• ★ AdGuard Home — alternative to Pi-hole; better defaults; DNS-over-HTTPS / TLS built in.
• NextDNS — hosted; per-device profiles; generous free tier.
• Technitium DNS — full-featured DNS server with web UI; auth + recursive + filtering in one.
• dnscrypt-proxy — encrypted resolution from the client.
• Blocky — Pi-hole-shape, lighter, Go-based.

Kubernetes-native

• ★ CoreDNS (CNCF) — k8s default; plugin chain; great for service discovery.
• ★ ExternalDNS — sync k8s ingress / service hostnames to DNS providers (Cloudflare, Route 53, etc.).
• node-local-dns — per-node DNS cache for k8s.

DNS-over-HTTPS / TLS

• ★ DNS-over-HTTPS (DoH) — RFC 8484; supported in browsers, OSes, dnscrypt-proxy.
• DNS-over-TLS (DoT) — RFC 7858; mostly used by mobile OSes.
• Servers that speak DoH/DoT: Unbound, AdGuard Home, Technitium, NextDNS, Cloudflare 1.1.1.1, Quad9.
• DoH proxies for legacy clients: dnscrypt-proxy, cloudflared.

DDNS / dynamic DNS

• Cloudflare API + small script — most popular DIY.
• DuckDNS — free dynamic DNS.
• No-ip / Dynu — alternatives.
• OPNsense / pfSense built-in DDNS clients.
• Inadyn — small dynamic-DNS daemon.

Common homelab topology

• AdGuard Home or Pi-hole in a container; DHCP points all clients at it.
• Cloudflare for public auth (your domain → CF nameservers).
• Cloudflare Tunnel for inbound.
• example.local zone via AdGuard for local services.

Patterns to adopt

• ★ Two recursive resolvers minimum for HA on a network.
• Cache-only is fine for most home / small office.
• DNSSEC — enable on authoritative if your registrar supports it; verify on recursors.
• Block lists carefully — false positives mean your phone can't reach iMessage. Pi-hole / AdGuard whitelisting is your friend.
• DoH locked-in browsers can bypass your local Pi-hole; configure browsers / phones to use the local resolver explicitly.

Pick this if…

• Default self-host authoritative: PowerDNS or Knot.
• Default recursor: Unbound.
• Home network ad-block: AdGuard Home (modern) or Pi-hole (classic).
• Hosted ad-block: NextDNS.
• Kubernetes: CoreDNS + ExternalDNS.
• One box, do it all (auth + recursive + filtering + DoH): Technitium.