A high-performance DNS server with flexible routing scheme and customized plugins.
中文版
Below is an example of using GeoIP to mitigate DNS pollution
table:
start:
- query: domestic
- check_secure
check_secure:
if: "!geoip(codes: [\"CN\"])"
then:
- query: secure
- end
- Fast (~50000 qps in wild where upstream perf is about the same)
- Flexible routing rules that are easy to compose and maintain
- Built-in plugins to manipulate your DNS queries and responses (you can also add or tailor them to your need)
- Fearless hot switch between network environments
- DNS over HTTPS support
- Written in pure Rust
[2021-9-16] Expression Engine and breaking changes
dcompass is now equipped with an expression engine which let you easily and freely compose logical expressions with existing matchers. This enables us to greatly improve config readablity and versatility. However, all existing config files involving if rule block are no longer working. Please see examples to migrate.
[2021-07-28] 2x faster and breaking changes
We adopted a brand new bare metal DNS library domain
which allows us to manipulate DNS messages without much allocation. This adoption significantly improves the memory footprint and throughput of dcompass. Due to this major refactorization, DoT/TCP/zone protocol are temporarily unavailable, however, UDP and DoH connections are now blazing fast. We will gradually put back those protocols.
dcompass -c path/to/config.json # Or YAML
Or you can simply run dcompass
from the folder where your configuration file named config.yml
resides.
You can also validate your configuration
dcompass -c path/to/config.json -v
See example.yaml
Configuration file contains different fields:
verbosity
: Log level filter. Possible values aretrace
,debug
,info
,warn
,error
,off
.address
: The address to bind on.table
: A routing table composed ofrule
blocks. The table cannot be empty and should contains a single rule named withstart
. Each rule containstag
,if
,then
, andelse
. Latter two of which are of the form(action1, action 2, ... , next)
(you can omit the action and write ONLY(next)
), which means take the actions first and goto the next rule with the tag specified.upstreams
: A set of upstreams.timeout
is the time in seconds to timeout, which takes no effect on methodHybrid
(default to 5).tag
is the name of the upstream.methods
is the method for each upstream.
Different actions:
blackhole
: Set response with a SOA message to curb further query. It is often used accompanied withqtype
matcher to disable certain types of queries.query(tag, cache policy)
: Send query via upstream with specified tag. Configure cache policy with one of the three levels:disabled
,standard
,persistent
. See also example.
Different matchers: (More matchers to come)
any
: Matches anything.domain(list of file paths or query name)
: Matches domain in specified domain lists. Supports gzip, lzma, and bzip2.qtype(list of record types)
: Matches record type specified.geoip(codes: list of country codes, path: optional path to the mmdb database file)
: If there is one or moreA
orAAAA
records at the current state and the first of which has got a country code in the list specified, then it matches, otherwise it always doesn't match.ipcidr(list of files that contain CIDR entries)
: Same asgeoip
, but it instead matches on CIDR. Supports gzip, lzma, and bzip2.header(cond: opcode|rcode|bits, query: bool)
: Matches the condition on query message header or response message header depending on the second option
Different querying methods:
https
: DNS over HTTPS querying methods.uri
is the remote server address in the form likehttps://cloudflare-dns.com/dns-query
.addr
is the server IP address (both IPv6 and IPv4) are accepted. HTTP and SOCKS5 proxies are also accepted on establishing connections viaproxy
, whose format is likesocks5://[user:[passwd]]@[ip:[port]]
.tls
: [CURRENTLY UNSUPPORTED] DNS over TLS querying methods.no_sni
means don't send SNI (useful to counter censorship).name
is the TLS certification name of the remote server.addr
is the remote server address.udp
: Typical UDP querying method.addr
is the remote server address.hybrid
: Race multiple upstreams together. the value of which is a set of tags of upstreams. Note, you can include anotherhybrid
inside the set as long as they don't form chain dependencies, which is prohibited and would be detected bydcompass
in advance.zone
: [CURRENTLY UNSUPOORTED] use local DNS zone file to provide customized responses. See also zone config example
See example.yaml for a pre-configured out-of-box anti-pollution configuration (Only works with full
or cn
version, to use with min
, please provide your own database).
You can download binaries at release page.
- GitHub Action build is set up
x86_64
,i686
,arm
, andmips
. Check them out on release page! - NixOS package is available at this repo as a flake. Also, for NixOS users, a NixOS modules is provided with systemd services and easy-to-setup interfaces in the same repository where package is provided.
└───packages
├───aarch64-linux
│ ├───dcompass-cn: package 'dcompass-cn-git'
│ └───dcompass-maxmind: package 'dcompass-maxmind-git'
├───i686-linux
│ ├───dcompass-cn: package 'dcompass-cn-git'
│ └───dcompass-maxmind: package 'dcompass-maxmind-git'
├───x86_64-darwin
│ ├───dcompass-cn: package 'dcompass-cn-git'
│ └───dcompass-maxmind: package 'dcompass-maxmind-git'
└───x86_64-linux
├───dcompass-cn: package 'dcompass-cn-git'
└───dcompass-maxmind: package 'dcompass-maxmind-git'
cache is available at cachix, with public key dcompass.cachix.org-1:uajJEJ1U9uy/y260jBIGgDwlyLqfL1sD5yaV/uWVlbk=
(outputs.publicKey
).
Mocked benchmark (server served on local loopback):
Gnuplot not found, using plotters backend
non_cache_resolve time: [20.548 us 20.883 us 21.282 us]
change: [-33.128% -30.416% -27.511%] (p = 0.00 < 0.05)
Performance has improved.
Found 11 outliers among 100 measurements (11.00%)
6 (6.00%) high mild
5 (5.00%) high severe
cached_resolve time: [2.6429 us 2.6493 us 2.6566 us]
change: [-90.684% -90.585% -90.468%] (p = 0.00 < 0.05)
Performance has improved.
Found 2 outliers among 100 measurements (2.00%)
1 (1.00%) high mild
1 (1.00%) high severe
- Support multiple inbound servers with different types like
DoH
,DoT
,TCP
, andUDP
. - RESTful API and web dashboard
- Expression engine and function style matcher syntax
- IP-CIDR matcher for both source address and response address
- GeoIP matcher for source address
- Custom response action
dcompass should be somewhere between a DNS resolver and DNS forwarder. Currently we don't fully comply RFC on some corner cases. And it is also not clear whether we should correct the incoming malformatted DNS requests. If you feel a particular compliance to RFC is necessary, please file an issue and we are willing to help!
All three components dmatcher
, droute
, dcompass
are licensed under GPLv3+.
dcompass
with geoip
feature gate enabled includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.