A couple of alternative DNS servers

One of our favorite things to worry about here at LWN is software monocultures. When everybody is running the same thing, a single vulnerability can compromise them all. The BIND nameserver package has thus occasionally come up as a topic of concern, since it has one of the strongest monopolies in the free software arena. There have been very few free alternatives to BIND which have become stable enough for people to trust them with their name service tasks.

That situation is changing, however. Over the last week, two different free DNS server implementations have announced new releases. So it seems like a good time to give them a look.

The announcement of the first public release of the Oak DNS server went out recently. Oak is written entirely in Python, with the result that it is portable to many systems (even Windows) and should be relatively resistent to buffer overrun attacks. Oak is licensed under the LGPL, and supports most of the features one would expect in a nameserver: recursion, master and slave modes, etc.

That said, Oak is very much a work in progress. It comes packaged as one big Python module and a driver script; no distutils installation support in sight. It reads the usual DNS master file format to get zone information, but the top-level configuration takes the form of a screenful or so of Python code - not something every system administrator will want to get into. Documentation is scarce; those wanting to make serious use of Oak at this point will likely have to delve into the code. This is definitely not Aunt Tillie's DNS server.

But the core functionality of Oak appears to be solid, and the project's maintainer (Ed Stoner) is responsive to problem reports. It would not take all that much work to turn Oak into a simple, secure, high-quality DNS server, especially for smaller installations. If you like Python programming, Oak is worth a look now; with luck it will be ready for everybody else in the near future.

For a very different sort of nameserver, see the announcement for PowerDNS 2.9.4. PowerDNS was, for some time, a proprietary system; it was released under the GPL in November of 2002. The pace of development seems to have picked up since then, and PowerDNS is evolving into an impressive system.

While Oak may be best suited to small networks, PowerDNS is clearly aimed at large ISPs and others who must serve huge numbers of domains. It can obtain its DNS information via several backends; it can, for example, run from an existing BIND configuration, or talk (using a pipe) to an arbitary process via a simple and well-documented protocol. The most developed backends, however, would appear to be those which work with a MySQL, PostgreSQL, or Oracle database. PowerDNS comes with a database scheme that it expects to use, but the SQL it uses is easily changed via the configuration file. PowerDNS, thus, will happily fit in with just any sort of in-house system used for the management of domain information.

PowerDNS also includes its own built-in web server which provides information on performance and the most frequent queries. It can also produce statistics meant to be fed directly to MRTG. PowerDNS supports the usual security features (setuid, chroot), and has been written for high performance when dealing with thousands of domains. It is also extensively documented on doc.powerdns.com.

The one thing that PowerDNS lacks is support for recursive name resolution. With its default configuration, if PowerDNS is does not have an authoritative answer for a given query, it refuses to answer at all. It is thus suitable for handling primary and secondary nameserver duties, but not for handling name lookups for users. That is changing, though; version 2.9.4 includes a recursive nameserver which can be built and run as a separate process. The plan, apparently, is to integrate that functionality into PowerDNS itself in the 2.9.5 release.

Oak and PowerDNS are not the only alternative free nameservers, of course. Some others which appear to be reasonably stable and under active development include:

• MaraDNS (a simple, recursive nameserver).
• MyDNS (an authoritative-only system which works with MySQL or PostgreSQL).
• NSD (authoritative-only).

(And yes, in order to forestall a flood of email, we should mention that the not-quite-free djbdns package is also out there).

BIND is a package with a long history of service; the Internet is literally built on it. Its security record is not that bad, considering its wide deployment and the amount of energy that has gone into finding vulnerabilities. But the security of the Net as a whole can only be improved by the emergence of solid, well-supported alternatives.

---

to post comments