View source for Comparison of DNS server software

{{short description|None}}

This article presents a comparison of the features, platform support, and packaging of many independent implementations of [[Domain Name System]] (DNS) [[name server]] software.

== Servers compared ==

Each of these [[Domain Name System|DNS]] servers is an independent implementation of the DNS protocols, capable of resolving DNS names for other computers, publishing the DNS names of computers, or both. Excluded from consideration are single-feature DNS tools (such as proxies, filters, and firewalls) and redistributions of servers listed here (many products repackage BIND, for instance, with proprietary user interfaces).

DNS servers are grouped into several categories of specialization of servicing domain name system queries.  The two principal roles, which may be implemented either uniquely or combined in a given product are:
* '''Authoritative server''': [[authoritative name server]]s publish DNS mappings for domains under their ''authoritative'' control. Typically, a company (e.g. "Acme Example Widgets") would provide its own authority services to respond to address queries, or for other DNS information, for ''www.example.int''.  These servers are listed as being at the top of the authority chain for their respective domains, and are capable of providing a definitive answer.  Authoritative name servers can be ''primary name servers'', also known as ''master'' servers, i.e. they contain the original set of data, or they can be ''secondary'' or ''slave name servers'', containing data copies usually obtained from synchronization directly with the primary server, either via a DNS mechanism, or by other data store synchronization mechanisms.
* '''Recursive server''': [[Domain Name System#Recursive and caching name server|recursive servers]] (sometimes called "DNS caches", "caching-only name servers") provide DNS name resolution for applications, by relaying the requests of the client application to the chain of authoritative name servers to fully resolve a network name. They also (typically) cache the result to answer potential future queries within a certain expiration ([[Time to live|time-to-live]]) period. Most Internet users access a ''recursive server'' provided by their internet service provider to locate internet [[Host (network)|hosts]] such as ''[[example.com|www.example.com]]''.

=== BIG-IP DNS ===
[[F5 Networks]] BIG-IP product line offers DNS as an authoritative or recursive server and adds additional security measures. Key advantage is to use the same application delivery controller to support DNS and application acceleration.{{Citation needed|date=January 2024}}

=== [[BIND]] ===
BIND is the ''[[de facto standard]]'' DNS server. It is a [[free software]] product and is distributed with most Unix and Linux platforms, where it is most often also referred to as ''named'' (name daemon). It is the most widely deployed DNS server.<ref name="autogenerated2004">{{cite web | last = Moore | first = Don | year = 2004 | url = http://mydns.bboy.net./survey/ | title = DNS server survey | accessdate = 2005-01-06 }}</ref> Historically, BIND underwent three major revisions, each with significantly different architectures: BIND4, BIND8, and BIND9. BIND4 and BIND8 are now technically obsolete and not considered in this article. BIND9 is a ground-up rewrite of BIND featuring complete [[Domain Name System Security Extensions|DNSSEC]] support in addition to other features and enhancements.

[[Internet Systems Consortium]] started development of a new version, BIND 10.  Its first release was in April 2010, but ISC involvement concluded with the release of BIND 10 version 1.2 in April 2014.  ISC cited a lack of resources to continue development of BIND 10, and they reaffirmed their commitment to BIND9.<ref>{{Cite web|url=http://www.isc.org/blogs/isc-concludes-bind-10-development-with-release-1-2-project-renamed-bundy/|title = ISC Concludes BIND 10 Development with Release 1.2|date = 17 April 2014}}</ref>

The BIND 10 codebase continues on as an open source project. It is not included in this comparison at this time.

=== [[Cisco Network Registrar]] ===
CNR includes a commercial DNS server from [[Cisco Systems]] usually used in conjunction with the CNR DHCP ([[Dynamic Host Configuration Protocol]]) server.  It supports high rates of dynamic update.

=== [[CoreDNS]] ===
CoreDNS is the recommended DNS server<ref>{{Cite web|url=https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/|title=Customizing DNS Service}}</ref> for [[Kubernetes]] and graduated from the CNCF in 2019.<ref>{{Cite web |url=https://www.theregister.co.uk/2019/01/24/cloud_contender_coredns/ |title=CoreDNS is all grown up now and ready to roll: Kubernetes network toolkit graduates at last |last=Claburn |first=Thomas |date=2019-01-24 |website=The Register |access-date=2020-01-20}}</ref>

=== [[Dnsmasq]] ===
Dnsmasq is a lightweight, easy to configure DNS forwarder, designed to provide DNS (and optionally [[Dynamic Host Configuration Protocol|DHCP]] and [[Trivial File Transfer Protocol|TFTP]]) services to a small-scale network. It can serve the names of local machines which are not in the global DNS.

Dnsmasq accepts DNS queries and either answers them from a small, local cache or forwards them to a real, recursive DNS server. It loads the contents of [[Hosts (file)|/etc/hosts]], so that local host names which do not appear in the global DNS can be resolved.

=== [[djbdns]] ===
Djbdns is a collection of DNS applications, including ''tinydns'', which was the second most used [[free software]] DNS server in 2004.<ref name="autogenerated2004"/> It was designed by [[Daniel J. Bernstein]], author of [[qmail]], with an emphasis on security considerations. In March 2009, Bernstein paid $1000 to the first person finding a security hole in djbdns.<ref>{{cite web|url=http://article.gmane.org/gmane.network.djbdns/13864|title=The djbdns prize claimed|accessdate=2009-03-04|archive-url=https://web.archive.org/web/20090305125545/http://article.gmane.org/gmane.network.djbdns/13864|archive-date=2009-03-05|url-status=dead}}</ref> The [[source code]] is not centrally maintained and was released into the public domain in 2007. There are multiple [[Fork (software development)|forks]] and more than a dozen [[Patch (computing)|patches]] to add additional features to djbdns.

=== gdnsd ===
gdnsd is a DNS server designed for geographic balancing.<ref>{{Cite web |title=gdnsd |url=https://gdnsd.org/ |access-date=2022-09-23 |website=gdnsd.org}}</ref> gdnsd is the DNS server used by Wikipedia for its servers and networking.<ref>{{Cite web |title=DNS - Wikitech |url=https://wikitech.wikimedia.org/wiki/DNS |access-date=2022-09-23 |website=wikitech.wikimedia.org |language=en}}</ref>

=== [[Knot DNS]] ===
Knot DNS is a [[free software]] authoritative DNS server by [[CZ.NIC]].  Knot DNS aims to be a fast, resilient DNS server usable for infrastructure (root and TLD) and [[DNS]] hosting services.  Knot DNS supports [[DNSSEC]] signing and among others hosts root zone (B, K, and L [[root name server]]s), several [[top-level domain]]s.

=== Knot Resolver ===
Knot Resolver is an [[open source]] modern resolver implementation designed for scalability, resiliency, and flexibility. Its core architecture is tiny and efficient, and most of the rich features are implemented as optional modules, which limits attack surface and improves performance.  Many resolver features are available out-of-the-box as modules while keeping core tiny and efficient. Modular architecture provides a state-machine like API for extensions, such as C and Lua modules.<ref>{{cite web |title=Knot Resolver |url=https://www.knot-resolver.cz/ |website=Knot Resolver |access-date=11 January 2024}}</ref>

=== [[MaraDNS]] ===
MaraDNS is a [[free software]] DNS server by Sam Trenholme that claims a good security history and ease of use.<ref>
{{cite book
  |last = Mens
  |first = Jan-Piet
  |title = Alternative DNS Servers: Choice and Deployment, and Optional SQL/LDAP Back-Ends (Paperback)
  |publisher = UIT Cambridge Ltd.
  |year = 2008
  |isbn = 978-0-9544529-9-5}}
</ref>
<ref>
{{cite web
|url=http://blogs.zdnet.com/security/?p=1562
|archive-url=https://web.archive.org/web/20080729044942/http://blogs.zdnet.com/security/?p=1562
|url-status=dead
|archive-date=July 29, 2008
|title=How OpenDNS, PowerDNS and MaraDNS remained unaffected by the DNS cache poisoning vulnerability
|last=Danchev
|first=Dancho
|publisher=[[ZDNet]]
|accessdate=2009-10-10
}}
</ref>
In order to change any DNS records, MaraDNS needs to be restarted. Like djbdns dnscache, the MaraDNS 2.0 stand-alone recursive resolver ("Deadwood") does not use threads.<ref>
{{cite web
|url= http://www.maradns.org/advocacy.html
|title= MaraDNS - A security-aware DNS server
|publisher=MaraDNS
|accessdate=2010-12-15
}}
</ref>

=== [[Microsoft DNS]] ===
Windows DNS Server <ref>{{cite web | url=http://www.microsoft.com/dns | title=Developer tools, technical documentation and coding examples | website=[[Microsoft]] }}</ref> component of Microsoft DNS. The same software can be configured to support authoritative, recursive and hybrid mode. The software is integrated with [[Active Directory]] which makes it the default DNS software for many enterprise networks that are based on [[Active Directory]]. It also allows creating zones by the standard DNS [[zone file]]. The software comes packaged as a role in [[Windows Server]]. The server software is shipped with a [[Command-line interface|command line]] application dnscmd,<ref>{{Cite web | url=https://technet.microsoft.com/en-us/library/cc756116(v=ws.10).aspx | title=DNSCMD Syntax: Domain Name System(DNS) | date=3 September 2012 }}</ref> a DNS management GUI wizard, and a DNS [[PowerShell]]<ref>{{Cite web |url=https://technet.microsoft.com/library/jj649850.aspx |title=Domain Name System (DNS) Server Cmdlets |access-date=2015-05-08 |archive-url=https://web.archive.org/web/20150518085941/https://technet.microsoft.com/library/jj649850.aspx |archive-date=2015-05-18 |url-status=dead }}</ref> package. In Windows Server 2012, the Windows DNS added support for DNSSEC,<ref>{{Cite web | url=https://technet.microsoft.com/library/dn593694 | title=DNSSEC in Windows Server 2012 | date=31 August 2016 }}</ref> with full-fledged online signing, with [[Dynamic DNS]] and [[NSEC3]] support, along with RSASHA and ECDSA signing algorithms. It provides an inbuilt key storage provider and support for any third party CNG compliant key storage provider. User interface and [[PowerShell]] support for managing DNS and DNSSEC were improved as well.
In the Windows Server 2016, the DNS Server supports DNS policies using which the admins can have more control over the name resolution process.<ref>{{Cite web | url=https://technet.microsoft.com/en-us/library/dn765484.aspx | title=What's New in DNS Server in Windows Server 2016 | date=20 October 2021 }}</ref>

=== [[NSD]] ===
NSD is a [[free software]] authoritative server provided by NLNet Labs. NSD is a test-bed server for DNSSEC; new DNSSEC protocol features are often prototyped using the NSD code base. NSD hosts several [[top-level domain]]s, and operates three of the [[root nameserver]]s.

=== [[pdnsd]] ===
Pdnsd is a caching DNS proxy server that stores cached DNS records on disk for long term retention. Pdnsd is designed to be highly adaptable to situations where net connectivity is slow, unreliable, unavailable, or highly dynamic, with limited capability of acting as an authoritative nameserver. It is licensed under the [[GPL]].<ref>{{cite web|url=http://www.phys.uu.nl/~rombouts/pdnsd/index.html#aboutpdnsd |title=The pdnsd Homepage |publisher=Phys.uu.nl |date= |accessdate=2011-10-26}}</ref>

=== [[Posadis]] ===
Posadis is a [[free software]] DNS server, written in C++, featuring [[Dynamic DNS]] update support.

=== [[PowerDNS]] ===
PowerDNS is a [[free software]] DNS server with a variety of data storage back-ends and load balancing features. Authoritative and recursive server functions are implemented as separate applications, as well as a separate DNS caching proxy (dnsdist) which implements features such as DNS over HTTPS.

=== [[Secure64 DNS]] ===
DNS Authority is commercial authoritative name server software from [[Secure64]], the company that built Genuinely Secure DNS applications and operating system and completely automated the deployment of DNSSEC.

DNS Cache is scalable, highly secure recursive DNS software from Secure64 which provides built-in protection against high-volume denial of service attacks, including Pseudo Random Sub Domain (PRSD) attacks.

=== [[Simple DNS Plus]] ===
Simple DNS Plus is a commercial DNS server product that runs under Microsoft Windows with an emphasis on a simple-to-use [[GUI]].  Maintenance of the software appears to have slackened in recent years.

=== Technitium DNS Server ===
Technitium DNS Server <ref>{{cite web | url=https://technitium.com/dns/ | title=Technitium DNS Server}}</ref><ref>{{cite web | url=http://linuxmafia.com/faq/Network_Other/dns-servers.html | title=DNS Server (and Related) Software for Unix}}</ref> is a [[free software|free]], opensource <ref>{{cite web | url=https://github.com/TechnitiumSoftware/DnsServer | title=Source Code| website=[[GitHub]]}}</ref> (GPLv3),<ref>{{cite web | url=https://github.com/TechnitiumSoftware/DnsServer/blob/master/LICENSE | title=GPLv3 License| website=[[GitHub]]}}</ref> cross platform, authoritative, caching and recursive DNS server software. It supports [[DNS over TLS|DNS-over-TLS]], [[DNS over HTTPS|DNS-over-HTTPS]], and [[DNS over QUIC|DNS-over-QUIC]] encrypted DNS protocols.<ref>{{cite web | url=https://dnsprivacy.org/implementation_status/#other-implementation-work | title=DNS Privacy Implementation Status}}</ref> It also supports [[Domain Name System Security Extensions|DNSSEC]] signing and validation for [[RSA (cryptosystem)|RSA]] and [[Elliptic Curve Digital Signature Algorithm|ECDSA]] algorithms with both NSEC and NSEC3.

The DNS server also features blocking domain names using block lists <ref>{{cite web | url=https://opensourcegeeks.net/5-top-self-hosted-opensource-dns-servers-like-pi-hole/ | title=5 Top Self-Hosted Opensource DNS Servers Like Pi-Hole| date=8 April 2023}}</ref> and also supports using HTTP or SOCKS5, for transport of DNS requests over [[Tor (network)|Tor network]].<ref>{{cite web | url=https://blog.technitium.com/2018/06/configuring-dns-server-for-privacy.html | title=Configuring DNS Server For Privacy & Security}}</ref>

The DNS server supports running independently developed plugins that can be used to process and respond to DNS requests. It also provides a HTTP API that can be used by 3rd party software to manage the DNS server.<ref>{{cite web | url=https://github.com/TechnitiumSoftware/DnsServer/blob/master/APIDOCS.md | title=Technitium DNS Server API Documentation| website=[[GitHub]]}}</ref>

=== [[Unbound (DNS Server)|Unbound]] ===
Unbound is a validating, recursive and caching DNS server designed for high performance. It was released on May 20, 2008 (version 1.0.0) as [[free software]] licensed under the BSD license by NLnet Labs.  It is installed as part of the base system in [[FreeBSD]] starting with version 10.0, and in [[NetBSD]] with version 8.0. A version is also available in [[OpenBSD]] version 5.6 and beyond.  (Previous versions of FreeBSD shipped with BIND.)

=== [[YADIFA]] ===
YADIFA  is a BSD-licensed, memory-efficient DNS server written in C. The acronym YADIFA stands for ''Yet Another DNS Implementation For All''. It was created by [[EURid]], which operates the .eu top-level domain.<ref>{{cite web |url=http://www.yadifa.eu/about |title=About YADIFA |accessdate=2013-04-11}}</ref>

== Features ==
Some DNS features are relevant only to recursive servers, or to authoritative servers. As a result, a feature matrix such as the one in this article cannot by itself represent the effectiveness or maturity of a given implementation.

Another important qualifier is the server architecture. Some DNS servers provide support for both server roles in a single, "monolithic" program. Others are divided into smaller programs, each implementing a subsystem of the server. As in the classic Computer Science [[microkernel]] debate, the importance and utility of this distinction is hotly debated. The feature matrix in this article does not discuss whether DNS features are provided in a single program or several, so long as those features are provided with the base server package and not with third-party add-on software.

=== Explanation of features ===
; Authoritative
: A major category of DNS server functionality, see above.

; Recursive
: A major category of DNS server functionality, see above.

; Recursion Access Control
: Servers with this feature provide control over which hosts are permitted DNS recursive lookups. This is useful for load balancing and service protection.

; Secondary Mode (or Slave Mode)
: Authoritative servers can publish content that originates from primary data storage (such as zone files or databases connected to business administration processes)--sometimes also called 'master' servers--or can be ''secondary'' (or ''slave'') servers, republishing content fetched from and synchronized with such primary servers. Servers with a "secondary mode" feature have a built-in capability to retrieve and republish content from other servers. This is typically, though not always, provided using the [[AXFR]] DNS protocol.

; Caching
: Servers with this feature provide recursive services for applications, and cache the results so that future requests for the same name can be answered quickly, without a full DNS lookup. This is an important performance feature, as it significantly reduces the latency of DNS requests.

; DNSSEC
: Servers with this feature implement some variant of the [[Domain Name System Security Extensions|DNSSEC]] protocols. They may publish names with resource record signatures (providing a "secure authority service"), and may validate those signatures during recursive lookups (providing a "secure resolver"). DNSSEC is becoming more widespread as the deployment of a DNSSEC root key has been done by [[ICANN]].  Deployment to individual sites is growing as top level domains start to deploy DNSSEC too. The presence of DNSSEC features is a notable characteristic of a DNS server.

; TSIG
: Servers with this feature typically provide DNSSEC services. In addition, they support the [[TSIG]] (Transaction SIGnature) protocol, which allows DNS clients to establish a secure session with the server to publish [[Dynamic DNS]] records or to request secure DNS lookups without incurring the cost and complexity of full DNSSEC support.

; IPv6
: Servers with this feature are capable of publishing or handling DNS records that refer to [[IPv6]] addresses. In addition to be fully IPv6 capable they must implement IPv6 transport protocol for queries and zone transfers in secondary/primary relationships and forwarder functions.

; Wildcard
: Servers with this feature can publish information for [[Wildcard DNS record|wildcard records]], which provide data about DNS names in DNS zones that are not specifically listed in the zone.

; Split horizon
: Servers with the [[split-horizon DNS]] feature can give different answers depending on the source IP address of the query.

=== Feature matrix ===
{{sort-under}}
{| class="sortable sort-under wikitable" style="font-size: 85%; text-align: center; width: auto;"
|-
! Server
! [[Name server#Authoritative name server|Authoritative]]
! [[Name server#Recursive query|Recursive]]
! Recursion [[Access control list|ACL]]
! Secondary mode
! [[Name server#Caching name server|Caching]]
! [[Domain Name System Security Extensions|DNSSEC]]
! [[TSIG]]
! [[IPv6]]
! [[Wildcard DNS record|Wildcard]]
! Free Software
! Interface
! [[Split-horizon DNS|split horizon]]
![[DNS over HTTPS]]
![[DNS over QUIC]]
|-
! [[F5 Networks|BIG-IP DNS]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}} 
| {{yes}} 
| {{no}}
| API, command line
| {{yes}}
| {{yes}}
| {{no}}
|-
! [[BIND]]
| {{yes}}
| {{Yes}}
| {{yes}}
| {{Yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}} (since 9.x)
| {{yes}} (since 4.x)
| {{yes}}
| Web{{r|group=Note|bind_web}}, command line
| {{yes}}
|{{Yes}}
|{{No}} {{r|group=Note|bind_DoQ}}
|-
! [[PowerDNS]]
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}{{r|group=Note|powerdns_sec6}}
| {{Yes}}
| {{Yes}} (since 3.0) {{r|group=Note|powerdns_dnssec}}
| {{Yes}} (since 3.0)
| {{Yes}}{{r|group=Note|powerdns_sec6}}
| {{Yes}}
| {{Yes}}
| REST, Web{{r|group=Note|powerdns_web}}, command line
| {{partial}}{{r|group=Note|powerdns_views}}
|{{Yes}} (in dnsdist)
|{{Yes}} {{r|group=Note|powerdns_DoQ}}
|-
! [[CoreDNS]]
| {{Yes}}
| {{Partial}} via proxying
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| API
| {{Yes}}
| {{Yes}}
| {{Yes}} (since 1.11) {{r|group=Note|coredns_DoQ}}
|-
! [[djbdns]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}{{r|group=Note|djbsec}}
| {{yes}}
| {{partial}}{{r|group=Note|djbdns_dnssec}}
| {{no}}
| {{partial}} via generic records. [http://www.fefe.de/dns/]
| {{partial}}{{r|group=Note|djbdns_wild}}
| {{yes}}
| command line and web ([http://vegadns.org/ VegaDNS] & [http://www.nictool.com/ NicTool])
| {{yes}}{{r|group=Note|locations}}
| {{no}}
| {{no}}
|-
! [[dbndns]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{yes}}
| {{partial}}
| {{yes}}
| command line and web
| {{yes}}
| {{no}}
| {{no}}
|-
! [[pdnsd]]
| {{partial}}
| {{yes}}
| {{partial}}
| {{partial}}
| {{yes}}
| {{no}} <ref>{{cite web
|url=http://gitorious.org/pdnsd/pdnsd/blobs/master/NEWS
|title=pdns NEWS
|accessdate=2013-03-29
|archive-url=https://web.archive.org/web/20130625091033/http://gitorious.org/pdnsd/pdnsd/blobs/master/NEWS
|archive-date=2013-06-25
|url-status=dead
}} "no support for the DNSSEC protocol itself yet in pdnsd"</ref>
| {{partial}}
| {{yes}}
| {{yes}}
| {{yes}}
| command line, pdnsd-ctl program
| {{partial}}
| {{no}}
| {{no}}
|-
! [[MaraDNS]]
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{partial}}{{r|group=Note|marasec}}
| {{yes}}
| {{no}}
| {{no}}
| {{partial}}
| {{yes}}
| {{yes}}
| command line
|  {{no}}
|  {{no}}
|  {{no}}
|-
! [[Posadis]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{Yes}}
| command line, API
| {{no}}
| {{no}}
| {{no}}
|-
! [[Unbound (DNS Server)|Unbound]]
| {{partial}}
| {{yes}}
| {{yes}}
| {{n/a}}
| {{yes}}
| {{yes}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| command line, API
| {{yes}}
|{{Yes}}
| {{Partial}}
|-
! [[Dnsmasq]]
| {{partial}}{{r|group=Note|masqauth}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}} (since 2.69) {{r|group=Note|masqdnssec}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| command line
| {{partial}}{{r|group=Note|masqsplit}}
|
| {{no}}
|-
! [[NSD]]
| {{Yes}}
| {{No}}
| {{n/a}}
| {{yes}}
| {{n/a}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{Yes}}
| command line
| {{no}}
|
| {{no}}
|-
! [[Knot DNS]]
| {{Yes}}
| {{No}}
| {{n/a}}
| {{yes}}
| {{n/a}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{Yes}}
| command line
| {{Yes}}{{r|group=Note|knotdns_modules}}
|
| {{Yes}}{{r|group=Note|knotdns_DoQ}}
|-
! [[Knot Resolver]]
| {{No}}
| {{Yes}}
| {{Yes}}
| {{n/a}}
| {{Yes}}
| {{Yes}}
| {{No}}{{r|group=Note|knotresolver_tsig}}
| {{Yes}}
| {{No}}
| {{Yes}}
| cli / socket
| {{No}}{{r|group=Note|knotresolver_sh}}
| {{Yes}}
| {{No}}
|-
! [[YADIFA]]
| {{Yes}}
| {{No}}
| {{n/a}}
| {{Yes}}
| {{n/a}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| {{Yes}}
| command line
| {{No}}
| {{No}}
| {{No}}
|-
! [[Microsoft DNS]]
| {{Yes}}
| {{Yes}}
| {{Yes}}{{r|group=Note|msdns_policies}}
| {{Yes}}
| {{Yes}}
| {{Yes}}{{r|group=Note|msdns_dnssec}}
| {{Yes}}{{r|group=Note|msdns_tsig}}
| {{Yes}}{{r|group=Note|msdns_ipv6}}
| {{yes}}
| {{No}}
| GUI, command line, API{{r|group=Note|msdns_api}}, [[Windows Management Instrumentation|WMI]]{{r|group=Note|msdns_wmi}}, [[MSRPC|RPC]]{{r|group=Note|msdns_rpc}}
| {{Yes}}{{r|group=Note|msdns_policies}}
|
| {{no}}
|-
! [[Simple DNS Plus]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{No}}
| GUI, Web, command line
| {{yes}}{{r|group=Note|sdns_views}}
|{{Yes}}
|{{no}}
|-
! [[Secure64 DNS|Secure64 DNS Authority]]
| {{yes}}
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| Command Line or Web GUI
| {{yes}}
|
| {{no}}
|-
! [[Secure64 DNS|Secure64 DNS Cache]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| Command Line or Web GUI
| {{yes}}
|
| {{no}}
|-
! Technitium DNS Server
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| Web GUI or HTTP API
| {{yes}}
| {{yes}}
| {{yes}}
|-
! style="width:20em" | Server
! Authoritative
! Recursive
! Recursion [[Access control list|ACL]]
! Secondary mode
! Caching
! [[Domain Name System Security Extensions|DNSSEC]]
! [[TSIG]]
! [[IPv6]]
! Wildcard
! Free Software
! Interface
! [[Split-horizon DNS|split horizon]]
![[DNS over HTTPS]]
![[DNS over QUIC]]
|}

{{reflist|group=Note|refs=
<ref name=bind_web>A BIND configuration module is available for Webmin in many Linux distributions.</ref>
<ref name=bind_DoQ>[https://gitlab.isc.org/isc-projects/bind9/-/issues/3635 BIND does not support DoQ yet]</ref>
<ref name=powerdns_DoQ>PowerDNS DNSdist 1.9.0. [https://blog.powerdns.com/2024/02/16/powerdns-dnsdist-1.9.0-released]</ref>
<ref name=coredns_DoQ>[https://coredns.io/2023/07/25/coredns-1.11.0-release/ Coredns 1.11.0]</ref>
<ref name=knotdns_DoQ>[https://www.knot-dns.cz/2023-08-28-version-330.html Knot DNS Version 3.3.0]</ref>
<ref name=djbsec>djbdns provides facilities to transfer zones; after completing the zone transfer, djbdns can act as an authoritative server for that zone. Consult the [http://cr.yp.to/djbdns/axfr-get.html axfr-get] documentation for further information.</ref>
<ref name=djbdns_dnssec>A patch for publishing authoritative DNSSEC-protected data is available at [http://www.tinydnssec.org].</ref>
<ref name=locations>This is not the same as views in bind. But it is a solution with comparable capabilities. See: [http://cr.yp.to/djbdns/tinydns-data.html#differentiation section of tinydns-data].</ref>
<ref name=masqauth>dnsmasq has limited authoritative support, intended for internal network use rather than public Internet use.{{Citation needed|date=February 2019}} A records are supported via /etc/hosts, and there is some MX, TXT and SRV record support via the command line.</ref>
<ref name=marasec>MaraDNS cannot directly provide secondary support. Instead, a zone transfer is needed, after which MaraDNS will act as an authoritative server for that zone. See [http://www.maradns.org/tutorial/dnsslave.html DNS Slave] for further information.</ref>
<ref name=msdns_dnssec>[[Windows Server 2008 R2]] [https://technet.microsoft.com/en-us/library/dd378952(WS.10).aspx supports DNSSEC], however [[dynamic DNS]] is not supported for DNSSEC-signed zones. It is [https://technet.microsoft.com/en-us/library/jj200224.aspx fully supported] in [[Windows Server 2012]]. For earlier versions, including Windows Server 2003, [[Domain Name System Security Extensions|DNSSEC]] functionality must be [http://technet2.microsoft.com/WindowsServer/en/Library/6e5ef496-7411-44ee-9b83-578238b8ec241033.mspx manually activated in the registry] {{webarchive|url=https://web.archive.org/web/20080325113621/http://technet2.microsoft.com/windowsserver/en/library/6E5EF496-7411-44EE-9B83-578238B8EC241033.mspx |date=2008-03-25 }}. In these versions, the DNSSEC support is sufficient to act as a slave/secondary server for a signed zone, but not sufficient to create a signed zone (lack of key generation and signing utilities).</ref>
<ref name=msdns_tsig>Microsoft DNS supports the [[Generic Security Service Algorithm for Secret Key Transaction|GSS-TSIG algorithm]] for Secure Dynamic Update when integrated with [[Active Directory]], using [http://www.rfc-editor.org/rfc/rfc3645.txt RFC 3645], an application of GSS-API [http://www.rfc-editor.org/rfc/rfc2743.txt RFC 2743].</ref>
<ref name=msdns_ipv6>[[IPv6]] functionality in the Microsoft DNS server is only available on Windows Server 2003 and newer.</ref>
<ref name=msdns_wmi>{{cite web|url=http://msdn.microsoft.com/en-us/library/ms682857.aspx |title=Microsoft DNS WMI Provider Specification |publisher=Msdn.microsoft.com |date= |accessdate=2011-10-26}}</ref>
<ref name=msdns_api>{{cite web|url=http://msdn.microsoft.com/en-us/library/ms682085(VS.85).aspx |title=Microsoft DNS Server API Reference |publisher=Msdn.microsoft.com |date= |accessdate=2011-10-26}}</ref>
<ref name=msdns_rpc>[http://msdn.microsoft.com/en-us/library/cc448821.aspx MS-DNSP DNS Server Management Protocol Specification] (uses [[Remote Procedure Call|RPC]]s)</ref>
<ref name=sdns_views>Simple DNS Plus does not have "views" in the same way as BIND, but has a "NAT IP Alias" feature which allows host records to resolve to different IP addresses depending on where the DNS request comes from.</ref>
<ref name=powerdns_views>Use the geoip backend for a split-horizon configuration.</ref>
<ref name=powerdns_sec6>IPv6 primary/secondary support in PowerDNS is incomplete in versions <3.0. Zone transfers in primary/secondary replication over IPv6 is supported since 3.0.</ref>
<ref name=powerdns_dnssec>Full DNSSEC support in PowerDNS arrived in version 3.0. In lower versions, it is currently restricted to being able to serve [http://doc.powerdns.com/types.html DNSSEC-related RRs].</ref>
<ref name=powerdns_web>[https://github.com/PowerDNS/pdns/wiki/WebFrontends Powerdns.com suggested enhancements at]</ref>
<ref name=djbdns_wild>djbdns supports [[wildcard DNS record]]s, but not in a way that conforms with the RFCs.</ref>
<ref name=masqdnssec>DNSSEC validation was added in Dnsmasq version 2.69 [http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2014q2/008416.html]. Earlier versions could only pass through validation results from their own upstream nameservers.[http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html]</ref>
<ref name=masqsplit>Dnsmasq can do basic split-horizon DNS based on the '''interface''' of the source request using the ''[http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html localise-queries]'' configuration parameter.</ref>
<ref name=msdns_policies>In Windows Server technical Preview (2016), you can create DNS policies to control how a DNS Server handles DNS queries based on different parameters. This supports Recursion control, location aware responses, split-brain deployment, filters etc. ''[https://technet.microsoft.com/en-us/library/dn765484.aspx]'' configuration parameter.</ref>
<ref name=knotdns_modules>Knot DNS provides query source address based responses via its [https://www.knot-dns.cz/docs/latest/html/modules.html#geoip-geography-based-responses geoip] and [https://www.knot-dns.cz/docs/latest/html/modules.html#queryacl-limit-queries-by-remote-address-or-target-interface queryacl] modules.</ref>
<ref name=knotresolver_tsig>As of v5.5.2 This just selects rule based on the key name, it doesn’t verify the key or signature yet. [https://knot-resolver.readthedocs.io/en/v5.5.2/modules-view.html?highlight=tsig#properties]</ref>
<ref name=knotresolver_sh>Setups like split-horizon which depend on isolated DNS caches are explicitly not supported. https://knot-resolver.readthedocs.io/en/v5.5.2/modules-view.html</ref>
}}

== Platforms ==
In this overview of [[operating system]] support for the discussed DNS server, the following terms indicate the level of support:
* ''No'' indicates that it does not exist or was never released.
* ''Partial'' indicates that while it works, the server lacks important functionality compared to versions for other OSs; it is still being developed however.
* ''Beta'' indicates that while a version is fully functional and has been released, it is still in development (e.g. for stability).
* ''Yes'' indicates that it has been officially released in a fully functional, stable version.
* ''Included'' indicates that the server comes pre-packaged with or has been integrated into the operating system.

This compilation is not exhaustive, but rather reflects the most common platforms today.

{| class="sortable wikitable" style="font-size: 85%; text-align: center; width: auto;"
|-
! style="width:20em" | Server
! [[Berkeley Software Distribution|BSD]]
! [[Solaris (operating system)|Solaris]]
! [[Linux]]
! [[Mac OS X]]
! [[Microsoft Windows|Windows]]
|-
! [[BIND]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{partial}}{{r|group=Note|ntbind}}{{r|group=Note|winbind}}
|-
! [[Microsoft DNS]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{included}}{{r|group=Note|msdns_included_functionality}}
|-
! [[djbdns]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
|-
! [[Dnsmasq]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
|-
! [[Simple DNS Plus]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|-
! [[NSD]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
|-
! [[Knot DNS]]
| {{yes}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
|-
! [[Knot Resolver]]
| {{yes}}
| {{?}}
| {{yes}}
| {{yes}}
| {{?}}
|-
! [[PowerDNS]]
| {{yes}}
| {{yes}} [http://www.solaris4you.dk/dnsservSS.html]
| {{yes}}
| {{beta}}
| {{no}}
|-
! [[MaraDNS]]
| {{yes}}
| {{yes}} [http://www.solaris4you.dk/dnsservSS.html]
| {{yes}}
| {{yes}}
| {{partial}}
|-
! [[pdnsd]]
| {{yes}} <!-- BSD -->
| {{partial}}<ref>{{cite web
|url=http://members.home.nl/p.a.rombouts/pdnsd/index.html
|title=pdnsd homepage
|accessdate=2013-03-29
}} "pdnsd was started on Linux, and has since been ported to FreeBSD (and Cygwin and Darwin). 90% of the source code should be easily portable to POSIX- and BSD-compatible systems, provided that those systems support the POSIX threads (pthreads). The rest might need OS-specific rewrites."</ref> <!-- Solaris -->
| {{yes}} <!-- Linux -->
| {{yes}} <!-- MaxOS -->
| {{no}} <!-- Windows -->
|-
! [[Posadis]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}} [http://posadis.sourceforge.net/]
|-
! [[Unbound (DNS Server)|Unbound]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
! [[Cisco Network Registrar]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{yes}}
|-
! [[YADIFA]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
|-
! [[Secure64 DNS|Secure64 DNS Authority]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
|-
! [[Secure64 DNS|Secure64 DNS Cache]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
|-
! Technitium DNS Server
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
|}
{{reflist|group=Note|refs=
<ref name=ntbind>BIND is available for [[Windows NT]]-based systems by ftp (including [[Windows 2000]], [[Windows XP|XP]], and [[Windows Server 2003|Server 2003]]) in a port (in contrib directory) known as ntbind (from version 9.3.3 Windows builds are present).</ref>
<ref name=winbind>Support for compiling and running BIND 9 natively on Windows has been completely removed as of 9.18.0.</ref>
<ref name=msdns_included_functionality>The functionality available with the Microsoft DNS server varies depending on the version of the underlying operating system; such as most Windows Server components, it is upgraded only with the rest of the operating system. Certain functionality, such as [[Domain Name System Security Extensions|DNSSEC]] and [[IPv6|IPv6 support]], is only available in the Windows Server 2000-2003 version. Windows 2000 Server includes [[TSIG]] support. The Microsoft DNS Server is not available on Windows client operating systems such as Windows XP.</ref>
}}

== Packaging ==
{| class="sortable wikitable" style="font-size: 85%; text-align: center; width: auto;"
|-
! style="width:20em" | Server
! Creator
! Cost ([[United States dollar|USD]])
! Public source code
! [[Software license]]
|-
! [[BIND]]
| [[Internet Systems Consortium]]
| Free
| {{Yes}}
| [[BSD license|BSD]], [[Mozilla Public License|MPL 2.0]] for 9.11+
|-
! [[Microsoft DNS]]
| [[Microsoft]]
| Included with [[Windows Server]]
| {{No}}
| [[Clickwrap|Clickwrap license]]
|-
! [[djbdns]]
| [[Daniel J. Bernstein]]
| Free
| {{Yes}}
| [[Public domain]]
|-
! [[Dnsmasq]]
| Simon Kelley
| Free
| {{Yes}}
| [[GNU General Public License|GPL]]
|-
! [[Simple DNS Plus]]
| JH Software
| $79 – $379
| {{No}}
| [[Clickwrap|Clickwrap license]]
|-
! [[NSD]]
| NLnet Labs
| Free
| {{Yes}}
| [[BSD licenses|BSD]] variant
|-
! [[Knot DNS]]
| [[CZ.NIC]]
| Free
| {{Yes}}
| [[GNU General Public License|GPL]]
|-
! [[Knot Resolver]]
| [[CZ.NIC]]
| Free
| {{Yes}}
| [[GNU General Public License|GPL]]
|-
! [[PowerDNS]]
| PowerDNS.COM BV / Bert Hubert
| Free
| {{Yes}}
| [[GNU General Public License|GPL]]
|-
! [[MaraDNS]]
| Sam Trenholme
| Free
| {{Yes}}
| [[BSD licenses|BSD]] variant
|-
! [[pdnsd]]
| Thomas Moestl and Paul Rombouts
| Free
| {{Yes}}
| [[GNU General Public License|GPL]]
|-
! [[Posadis]]
| Meilof Veeningen
| Free
| {{Yes}}
| [[GNU General Public License|GPL]]
|-
! [[Unbound (DNS Server)|Unbound]]
| NLnet Labs
| Free
| {{Yes}}
| [[BSD license|BSD]]
|-
! [[YADIFA]]
| EURid
| Free
| {{Yes}}
| [[BSD license|BSD]]
|-
! [[Secure64 DNS|Secure64 DNS Authority]]
| [[Secure64]]
| Unpublished price
| {{No}}
| [[Clickwrap|Clickwrap license]]
|-
! [[Secure64 DNS|Secure64 DNS Cache]]
| [[Secure64]]
| Unpublished price
| {{No}}
| [[Clickwrap|Clickwrap license]]
|-
! Technitium DNS Server
| Technitium
| Free
| {{yes}}
| [[GNU General Public License|GPL]]
|}

== See also ==
*[[Comparison of DHCP server software]]
* [[DNS management software]]
* [[Public recursive name server]]

== References ==
{{reflist}}

== External links ==
* [http://mydns.bboy.net/survey/ Don Moore's May 2004 DNS Internet survey]
* [http://dns.measurement-factory.com/surveys/sum1.html The Measurement Factory DNS Survey Summary: April & June 2005]
* [http://www.cs.cornell.edu/People/egs/beehive/dnssurvey.html Beehive/CoDoNS DNS Survey: July 2004]
* [http://www.itu.int/itudoc/itu-t/workshop/cctld/cctld046.pdf ITU ccTLD DNS Survey]

{{DEFAULTSORT:Comparison Of Dns Server Software}}
[[Category:Network software comparisons|DNS server software]]
[[Category:DNS software]]