API tools faq
paste
ajoergensen

dnsdist.yml

ajoergensen
Sep 17th, 2025
38
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
YAML 7.68 KB | None | 0 0
raw download clone embed print report
  1. # Listeners
  2. binds:
  3.   - listen_address: "0.0.0.0:53"
  4.     protocol: Do53
  5.     reuseport: true
  6.     threads: 6
  7.     tcp:
  8.       fast_open_queue_size: 256
  9.   - listen_address: "0.0.0.0:443"
  10.     protocol: DoH
  11.     reuseport: true
  12.     threads: 4
  13.     tcp:
  14.       fast_open_queue_size: 256
  15.     tls:
  16.       certificates:
  17.         - certificate: "/etc/dnsdist/dnsdist-ecc.crt"
  18.           key: "/etc/dnsdist/dnsdist-ecc.key"
  19.         - certificate: "/etc/dnsdist/dnsdist-rsa.crt"
  20.           key: "/etc/dnsdist/dnsdist-rsa.key"
  21.       ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"
  22.       ciphers_tls_13: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
  23.     doh:
  24.       paths:
  25.        - "/dns-query"
  26.   - listen_address: "0.0.0.0:443"
  27.     protocol: DoH3
  28.     reuseport: true
  29.     threads: 4
  30.     tls:
  31.       certificates:
  32.         - certificate: "/etc/dnsdist/dnsdist-ecc.crt"
  33.           key: "/etc/dnsdist/dnsdist-ecc.key"
  34.         - certificate: "/etc/dnsdist/dnsdist-rsa.crt"
  35.           key: "/etc/dnsdist/dnsdist-rsa.key"
  36.       ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"
  37.       ciphers_tls_13: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
  38.     doh:
  39.       paths:
  40.        - "/dns-query"
  41.   - listen_address: "0.0.0.0:853"
  42.     protocol: DoT
  43.     reuseport: true
  44.     threads: 4
  45.     tcp:
  46.       fast_open_queue_size: 256
  47.     tls:
  48.       certificates:
  49.         - certificate: "/etc/dnsdist/dnsdist-ecc.crt"
  50.           key: "/etc/dnsdist/dnsdist-ecc.key"
  51.         - certificate: "/etc/dnsdist/dnsdist-rsa.crt"
  52.           key: "/etc/dnsdist/dnsdist-rsa.key"
  53.       ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"
  54.       ciphers_tls_13: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
  55.   - listen_address: "0.0.0.0:784"
  56.     protocol: DoQ
  57.     reuseport: true
  58.     threads: 4
  59.     tls:
  60.       certificates:
  61.         - certificate: "/etc/dnsdist/dnsdist-ecc.crt"
  62.           key: "/etc/dnsdist/dnsdist-ecc.key"
  63.         - certificate: "/etc/dnsdist/dnsdist-rsa.crt"
  64.           key: "/etc/dnsdist/dnsdist-rsa.key"
  65.       ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"
  66.       ciphers_tls_13: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
  67.   - listen_address: "0.0.0.0:853"
  68.     protocol: DoQ
  69.     reuseport: true
  70.     threads: 4
  71.     tls:
  72.       certificates:
  73.         - certificate: "/etc/dnsdist/dnsdist-ecc.crt"
  74.           key: "/etc/dnsdist/dnsdist-ecc.key"
  75.         - certificate: "/etc/dnsdist/dnsdist-rsa.crt"
  76.           key: "/etc/dnsdist/dnsdist-rsa.key"
  77.       ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"
  78.       ciphers_tls_13: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
  79.    
  80. acl:
  81.  - 10.0.0.0/8
  82.   - 100.64.0.0/10
  83.   - 127.0.0.1/32
  84. # Some entries removed
  85.    
  86. # Increase the in-memory rings size (the default, 10000, is only one second at 10k qps) used by
  87. # live-traffic inspection features like grepq, and use 100 shards to improve performance
  88. ring_buffers:
  89.   size: 1000000
  90.   shards: 100
  91.  
  92. netmask_groups:
  93.   - name: "dc_networks"
  94.     netmasks:
  95.      - "10.20.0.0/24"
  96.       - "10.20.1.0/24"
  97.       - "10.20.16.0/24"
  98.   - name: "partner_networks"
  99.     netmasks:
  100.      - "192.168.96.0/24"
  101.       - "10.128.0.0/16"
  102.  
  103.  
  104. query_rules:
  105.   - selector:
  106.       type: "QName"
  107.       qname: "use-application-dns.net"
  108.     action:
  109.       type: "RCode"
  110.       rcode: "NXDOMAIN"
  111.  
  112. # Define load balancing method
  113. # Using 'first available' should steer most traffic locally while
  114. # whashed uses weighted policy, but assigns questions with identical hash to identical servers,
  115. # allowing for better cache concentration (‘sticky queries’).
  116. load_balancing_policies:
  117.   default_policy: "firstAvailable"
  118.   consistent_hashing_balancing_factor: 1.1
  119.  
  120. backends:
  121.   - address: "127.0.0.1:5300"
  122.     name: "local"
  123.     order: 1
  124.     protocol: "Do53"
  125.     weight: 100000
  126.     queries_per_second: 15000
  127.     use_proxy_protocol: true
  128.     use_client_subnet: true
  129.     sockets: 8
  130.     health_checks:
  131.       mode: "lazy"
  132.       interval: 1
  133.       max_failures: 3
  134.       rise: 2
  135.       lazy:
  136.         mode: "TimeoutOnly"
  137.         threshold: 30
  138.         min_sample_count: 10
  139.         sample_size: 100
  140.   - address: "80.71.82.118:5300"
  141.     name: "anycastdns10"
  142.     order: 3
  143.     protocol: "Do53"
  144.     weight: 1000
  145.     queries_per_second: 5000
  146.     use_proxy_protocol: true
  147.     use_client_subnet: true
  148.     sockets: 8
  149.     health_checks:
  150.       mode: "lazy"
  151.       interval: 1
  152.       max_failures: 3
  153.       rise: 2
  154.       lazy:
  155.         mode: "TimeoutOnly"
  156.         threshold: 30
  157.         min_sample_count: 10
  158.         sample_size: 100
  159. # Some entries removed
  160.  
  161. # eBPF map configuration
  162. ebpf:
  163.   ipv4:
  164.     max_entries: 8192
  165.   ipv6:
  166.     max_entries: 1024
  167.   cidr_ipv4:
  168.     max_entries: 8192
  169.   cidr_ipv6:
  170.     max_entries: 1024
  171.   qnames:
  172.     max_entries: 8192
  173.   external: false
  174.  
  175. dynamic_rules_settings:
  176.   default_action: "Refused"
  177.  
  178. # Generate a warning if we detect a query rate above 100 qps for at least 10s.
  179. # If the query rate raises above 300 qps for 10 seconds, we'll block the client for 60 seconds.
  180. dynamic_rules:
  181.   - name: "query-rate"
  182.     mask_ipv4: 32
  183.     mask_ipv6: 64
  184.     rules:
  185.       - type: "query-rate"
  186.         rate: 300
  187.         seconds: 10
  188.         action_duration: 60
  189.         warning_rate: 100
  190.         comment: "query rate exceeded"
  191.       - type: "qtype-rate"
  192.         qtype: 255 # ANY
  193.         rate: 5
  194.         seconds: 10
  195.         action_duration: 60
  196.         comment: "ANY rate exceeded"
  197.   - name: "rcode-rate"
  198.     mask_ipv4: 32
  199.     mask_ipv6: 64
  200.     rules:
  201.       - type: "rcode-rate"
  202.         rcode: "NXDOMAIN"
  203.         rate: 20
  204.         seconds: 10
  205.         action_duration: 60
  206.         comment: "NXDOMAIN rate exceeded"
  207.       - type: "rcode-rate"
  208.         rcode: "SERVFAIL"
  209.         rate: 20
  210.         seconds: 10
  211.         action_duration: 60
  212.         comment: "SERVFAIL rate exceeded"
  213.  
  214. # Configure packet cache
  215. packet_caches:
  216.   - name: "default-cache"
  217.     size: 5000000
  218.     max_ttl: 600
  219.     min_ttl: 0
  220.     temporary_failure_ttl: 10
  221.     stale_ttl: 60
  222.     max_negative_ttl: 60
  223.     shards: 20
  224.     dont_age: false
  225.    
  226. pools:
  227.   - name: ""
  228.     packet_cache: "default-cache"
  229.   - name: "internal"
  230.     packet_cache: "internal-cache"
  231.  
  232. # Webserver for API
  233. webserver:
  234.   listen_addresses:
  235.    - "127.0.0.1:8083"
  236.   password: "$scrypt$ln=10,p=1,r=8$V42g5Qybm8qPFcABMIUz/w==$A8AnugHML7flTJuDBoFnTPaon9Q/aoo66KU+EZp8x9E="
  237.   api_key: "$scrypt$ln=10,p=1,r=8$tYW5Y0qXUNHWeU8Reg+fwA==$xGPc/d7QvOyk6KBfX10mU+KLkjSEg5woT1Mc6Ur1rmc="
  238.   stats_require_authentication: false
  239.   acl:
  240.    - "127.0.0.0/8"
  241.  
  242. console:
  243.   listen_address: "127.0.0.1"
  244.   key: "<REDACTED>"
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!