DNS Security Configuration Guides

Protect DNS integrity and privacy with DNSSEC and DNS over TLS. These guides cover zone signing, key management, DoT/DoH configuration, and DNSSEC validation.

BIND

The most widely used DNS server.

dnsdist

DNS load balancer with DoT/DoH support.

Knot Resolver

Modern recursive DNS resolver with DoT/DoH.

PowerDNS

Authoritative DNS with built-in DNSSEC.

Unbound

Validating recursive DNS resolver.

About These Guides

DNS is foundational infrastructure: if an attacker can poison your resolver cache or intercept unencrypted DNS queries, they can redirect users to malicious hosts regardless of how well your TLS certificates are configured. DNSSEC prevents cache poisoning by cryptographically signing zone data. DNS over TLS (DoT) and DNS over HTTPS (DoH) encrypt the query transport to prevent eavesdropping and manipulation.

These guides cover both authoritative server configuration (zone signing with DNSSEC) and recursive resolver configuration (validation, DoT forwarding, DoH serving), as well as the DNS load-balancer tools that sit in front of them.