dnsdist.conf

-- Main listener
setLocal("0.0.0.0:53", { reusePort=true, useClientSubnet=true, tcpFastOpenSize=5, doTCP=true, cpu={0}, numberOfShards=16 })

-- Additional listener threads
addLocal("0.0.0.0:53", {reusePort=true, useClientSubnet=true, tcpFastOpenSize=5, doTCP=true, cpu={ 1 }, numberOfShards=16 })
addLocal("0.0.0.0:53", {reusePort=true, useClientSubnet=true, tcpFastOpenSize=5, doTCP=true, cpu={ 2 }, numberOfShards=16 })
addLocal("0.0.0.0:53", {reusePort=true, useClientSubnet=true, tcpFastOpenSize=5, doTCP=true, cpu={ 3 }, numberOfShards=16 })

-- Increase the in-memory rings size (the default, 10000, is only one second at 10k qps) used by
-- live-traffic inspection features like grepq, and use 100 shards to improve performance
setRingBuffersSize(1000000, 100)

-- ACL for customer networks
addACL("10.0.0.0/8")
addACL("100.64.0.0/10")
addACL("127.0.0.1/32")
-- some addACL lines removed

-- load balancing policy. Using 'first available' should steer most traffic locally
-- https://dnsdist.org/guides/serverselection.html#firstavailable
setServerPolicy(firstAvailable)
newServer({address="80.71.82.2:5300",name="anycastdns21",qps=5000,order="1",useProxyProtocol=true})
newServer({address="80.71.82.118:5300",name="anycastdns10",qps=5000,order="3",useProxyProtocol=true})
-- Some newServer lines removed

-- Define rate limits

-- Dynamic rules
local dbr = dynBlockRulesGroup()

-- Generate a warning if we detect a query rate above 100 qps for at least 10s.
-- If the query rate raises above 300 qps for 10 seconds, we'll block the client for 60 seconds.
dbr:setQueryRate(300, 10, "Exceeded query rate", 60, 100)

-- If more than 20 NXD responses per second measured over 10 seconds, block for 60 seconds
dbr:setRCodeRate(DNSRCode.NXDOMAIN, 20, 10, "Exceeded NXD rate", 60)

-- If more than 20 SERVFAIL responses per second measured over 10 seconds, block for 60 seconds
dbr:setRCodeRate(DNSRCode.SERVFAIL, 20, 10, "Exceeded ServFail rate", 60)

-- If more than 5 ANY qps measured over 10 seconds, block for 60 seconds
dbr:setQTypeRate(DNSQType.ANY, 5, 10, "Exceeded ANY rate", 60)

-- If more than 10Kb/s responses measured over 10 seconds. Disabled for now.
-- dbr:setResponseByteRate(10000, 10, "Exceeded resp BW rate", 60)


function maintenance()
  dbr:apply()
end

-- Configure packet cache
pc = newPacketCache(1000000, {maxTTL=600, minTTL=0, temporaryFailureTTL=10, staleTTL=60, maxNegativeTTL=60, numberOfShards=4, dontAge=false})
getPool(""):setCache(pc)

-- Webserver for API
webserver("127.0.0.1:8083")
setWebserverConfig({statsRequireAuthentication=false, apiKey='$scrypt$ln=10,p=1,r=8$tYW5Y0qXUNHWeU8Reg+fwA==$xGPc/d7QvOyk6KBfX10mU+KLkjSEg5woT1Mc6Ur1rmc=', acl='192.168.1.0/24, 172.25.1.0/24, 127.0.0.0/8', password='$scrypt$ln=10,p=1,r=8$V42g5Qybm8qPFcABMIUz/w==$A8AnugHML7flTJuDBoFnTPaon9Q/aoo66KU+EZp8x9E='})

-- Control socket (for using the local console
controlSocket("127.0.0.1")
setKey("<REDACTED>")


-- Define DNS-over-HTTPS interface
addDOHLocal('0.0.0.0', { '/etc/dnsdist/dnsdist-ecc.crt', '/etc/dnsdist/dnsdist-rsa.crt'}, { '/etc/dnsdist/dnsdist-ecc.key', '/etc/dnsdist/dnsdist-rsa.key'}, { '/', '/dns-query' }, { reusePort=true, minTLSVersion='tls1.2', ciphers='ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305', ciphersTLS13='TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256', tcpFastOpenQueueSize=256,  })

-- Define DNS-over-TLS interface
addTLSLocal('0.0.0.0', { '/etc/dnsdist/dnsdist-ecc.crt', '/etc/dnsdist/dnsdist-rsa.crt'}, { '/etc/dnsdist/dnsdist-ecc.key', '/etc/dnsdist/dnsdist-rsa.key'}, { reusePort=true, minTLSVersion='tls1.2', ciphers='ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305', ciphersTLS13='TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256', tcpFastOpenQueueSize=256 })

-- Block Firefox automatic DoH (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet)
addAction('use-application-dns.net', RCodeAction(DNSRCode.NXDOMAIN))