kixdns

What KixDNS is

KixDNS is an asynchronous, non recursive DNS forwarding server written in Rust. It listens for queries over UDP and TCP, optionally accepts inbound DNS over HTTPS, and then applies an ordered set of pipeline rules before forwarding the request or constructing a response itself. The project README states plainly that the implementation, documentation, and initial code were generated by AI, which is an unusual disclosure for a networking tool. Under the hood it is built on tokio for async I/O, with concurrent state managed by DashMap and moka. Performance choices include zero copy UDP processing with BytesMut, lazy request parsing that skips full deserialization when no rule needs parsed fields, and fast hashing through rustc-hash. An adaptive flow control layer named PermitManager adjusts concurrency based on upstream latency, and worker aware UDP sockets use the platform reuse port support on Unix while non Unix builds share one socket. The default listener addresses are UDP and TCP on 0.0.0.0:5353, and the default upstream resolver is 1.1.1.1:53. The project uses Rust edition 2024 and does not declare a minimum supported Rust version, so a recent toolchain is expected. That recent edition means the code can use the latest Rust features, but it also means an older compiler will refuse to build the project until it is updated.

Routing and pipeline rules

Routing is the heart of KixDNS, and it is expressed as ordered pipeline selection followed by ordered request rules. A pipeline can be chosen by listener label, client IP, domain, query class, EDNS presence, GeoIP country, GeoSite tag, or query type, and matchers can be combined with logical operators such as and, or, and_not, or_not, and not. Within a pipeline, request rules run in configuration order, and a second response phase can match on the upstream answer and trigger actions such as upstream fallback, filtering, or response replacement. Upstream transports cover UDP, TCP, TCP plus UDP hedging, DoH, DoT, and DoQ, selected either by a transport field or by URL prefixes like udp://, tcp://, doh://, dot://, and doq://. EDNS Client Subnet support arrives through RFC 7871, with pipeline level cache isolation and Forward action request rewriting. This design lets an operator send internal domains to one upstream and public domains to another, or block specific suffixes with a static response. DoQ 0-RTT is enabled globally by default and is turned off for an upstream after a rejection or timeout until the process restarts. The response phase also supports matching on answer IP and on TXT content, so an operator can react to what an upstream actually returned rather than only to the original query.

Cache, transports, and operations

Caching and reliability features keep the resolver useful under load. An in memory cache holds a configurable number of entries with a maximum lifetime, a minimum TTL floor, and optional stale serving per RFC 8767, which returns expired entries when upstream access fails. Identical in flight cache misses share one upstream operation, and near expiry entries can be refreshed in the background. GeoIP support loads MaxMind MMDB files and V2Ray GeoSite data, with file watchers that reload both when the files change. Operations are friendly to live systems: valid JSON configuration changes reload through the file watcher while invalid changes keep the previous configuration. Logging is text formatted by default with RFC 3339 timestamps, and a command line tool converts a V2Ray GeoIP .dat file into MMDB. A browser based visual config editor can generate the pipeline.json file for newcomers. The code is published under the GPL-3.0 license, and the repository ships a systemd unit template so the daemon can run as a managed service on Linux hosts. The hot reload path means an operator can tweak routing during the day without dropping existing queries, which is important for a resolver that sits in the request path for real users.

Editorial conclusion

KixDNS is licensed under GPL-3.0, listens on 0.0.0.0:5353 by default, and forwards to 1.1.1.1:53 unless a pipeline overrides the upstream.