djbdns

djbdns
Developer(s)	Daniel J. Bernstein
Initial release	March 25, 2000; 24 years ago
Stable release	1.05 / February 11, 2001; 23 years ago
Operating system	Unix-like
Type	DNS server
License	Public domain
Website	cr.yp.to/djbdns.html

The djbdns software package is a

security hole in djbdns, which was awarded^[2]

in March 2009 to Matthew Dempsky.

As of 2004 [update], djbdns's tinydns component was the second most popular DNS server in terms of the number of domains for which it was the authoritative server, and third most popular in terms of the number of DNS hosts running it.^[3]

djbdns has never been vulnerable to the widespread

cache poisoning vulnerability reported in July 2008,^[4]^[5] but it has been discovered that it is vulnerable to a related attack.^[6]

The

Debian Project), and more than a dozen patches to modify the released version.^[8]

While djbdns does not directly support

DNSSEC, there are third party patches to add DNSSEC support to djbdns' authoritative-only tinydns component.^[9]

Components

The djbdns software consists of servers, clients, and miscellaneous configuration tools.

Servers

dnscache — the DNS resolver and cache.
tinydns — a database-driven DNS server.
walldns — a "reverse DNS wall", providing IP address-to-domain name lookup only.
rbldns — a server designed for DNS blacklisting service.
pickdns — a database-driven server that chooses from matching records depending on the requestor's location. (This feature is now a standard part of tinydns.)
axfrdns — a zone transfer server.

Client tools

axfr-get — a zone-transfer client.
dnsip — simple address from name lookup.
dnsipq — address from name lookup with rewriting rules.
dnsname — simple name from address lookup.
dnstxt — simple text record from name lookup.
dnsmx — mail exchanger lookup.
dnsfilter — looks up names for addresses read from stdin, in parallel.
dnsqr — recursive general record lookup.
dnsq — non-recursive general record lookup, useful for debugging.
dnstrace (and dnstracesort) — comprehensive testing of the chains of authority over DNS servers and their names.

Design

In djbdns, different features and services are split off into separate programs. For example, zone transfers, zone file parsing,

caching, and recursive resolving are implemented as separate programs. The result of these design decisions is a reduction in code size and complexity of the daemon program that provides the core function of answering lookup requests. Bernstein asserts that this is true to the spirit of the Unix operating system, and makes security verification much simpler.^{[citation needed}

]

Copyright status

On December 28, 2007, Bernstein released djbdns into the public domain.^[10] Previously the package was distributed free of charge as license-free software. However this did not permit the distribution of modified versions of djbdns, which was one of the core principles of open-source software. Consequently, it was not included in those Linux distributions which required all components to be open-source.

References

^ "The djbdns security guarantee". Archived from the original on 2012-07-06. Retrieved 2008-09-02.
^ "The djbdns prize claimed". Archived from the original on 2009-03-05. Retrieved 2009-03-04.
^ Moore, Don (2004). "DNS server survey". Archived from the original on 2005-01-06. Retrieved 2005-01-06.
^ "Multiple DNS implementations vulnerable to cache poisoning". Archived from the original on 2008-07-25. Retrieved 2008-08-05.
^ "An Astonishing Collaboration". 9 July 2008. Archived from the original on 2008-08-04. Retrieved 2008-08-05.
^ Day, Kevin (2009). "Rapid DNS Poisoning in djbdns". Archived from the original on 2009-02-21. Retrieved 2009-02-23.
^ "djbdns is placed in the public domain". Archived from the original on 2012-05-25. Retrieved 2008-01-01.
^ "Detailed overview of DNS server software by Rick Moen". Archived from the original on 2009-07-27. Retrieved 2009-07-13.
^ "DNSSEC for TinyDNS". Archived from the original on 2016-01-26. Retrieved 2016-01-19.
^ "Frequently asked questions from distributors". Archived from the original on 2012-05-25. Retrieved 2007-12-31.

External links

djbdns official homepage
N-DJBDNS
A guide to djbdns
The djbdns section of FAQTS
A djbdns guide and tutorial with addon
Jonathan de Boyne Pollard. "Some of what is said about djbdns is wrong". Frequently Given Answers. Archived from the original on 2011-02-13. — Jonathan de Boyne Pollard's debunking of several myths relating to djbdns
Jonathan de Boyne Pollard. "The known problems with Dan Bernstein's djbdns". Frequently Given Answers. Archived from the original on 2010-04-25. Retrieved 2009-09-20. — Jonathan de Boyne Pollard's list of the several known problems in djbdns
Supporting newer record formats through generic records. Archived 2005-06-07 at the Wayback Machine
LWN (Linux weekly news) looks at djbdns

[1] "The djbdns security guarantee". Archived from the original on 2012-07-06. Retrieved 2008-09-02.

[2] "The djbdns prize claimed". Archived from the original on 2009-03-05. Retrieved 2009-03-04.

[3] Moore, Don (2004). "DNS server survey". Archived from the original on 2005-01-06. Retrieved 2005-01-06.

[4] "Multiple DNS implementations vulnerable to cache poisoning". Archived from the original on 2008-07-25. Retrieved 2008-08-05.

[5] "An Astonishing Collaboration". 9 July 2008. Archived from the original on 2008-08-04. Retrieved 2008-08-05.

[6] Day, Kevin (2009). "Rapid DNS Poisoning in djbdns". Archived from the original on 2009-02-21. Retrieved 2009-02-23.

[7] "djbdns is placed in the public domain". Archived from the original on 2012-05-25. Retrieved 2008-01-01.

[8] "Detailed overview of DNS server software by Rick Moen". Archived from the original on 2009-07-27. Retrieved 2009-07-13.

[9] "DNSSEC for TinyDNS". Archived from the original on 2016-01-26. Retrieved 2016-01-19.

[10] "Frequently asked questions from distributors". Archived from the original on 2012-05-25. Retrieved 2007-12-31.

[2]

[3]

[4]

[5]

[6]

[8]

[9]

[10]