kresd(8) | Knot Resolver 3.2.1 | kresd(8) |
kresd - Knot 3.2.1 full caching resolver.
kresd [-a|--addr addr[@port]] [-t|--tls addr[@port]] [-S|--fd fd] [-T|--tlsfd fd] [-c|--config config] [-k|--keyfile keyfile] [-K|--keyfile-ro keyfile] [-m|--moduledir path] [-f|--forks N] [-q|--quiet] [-v|--verbose] [-V|--version] [-h|--help] [rundir]
Knot Resolver is a DNSSEC-enabled full caching resolver.
Default mode of operation: when it receives a DNS query it iteratively asks authoritative nameservers starting from root zone (.) and ending with a nameservers authoritative for queried name. Automatic DNSSEC means verification of integrity of authoritative responses by following keys and signatures starting from root. Root trust anchor is automatically bootstrapped from IANA, or you can provide a file with root trust anchors (same format as Unbound or BIND9 root keys file).
The daemon also caches intermediate answers into cache, which by default uses LMDB memory-mapped database. This has a significant advantage over in-memory caches as the process may be stopped and restarted without loss of cache entries. In multi-user scenario a shared cache is potential privacy/security issue, with kresd each user can have resolver cache in their private directory and use it in similar fashion to keychain.
By default, no configuration is needed, only a directory where the daemon can store runtime data (cache, control sockets, ...)
To use a locally running kresd for resolving put
into resolv.conf(5) and start kresd
$ kresd -a 127.0.0.1 -k root.keys [system] interactive mode >
The daemon may be configured also as a plain forwarder using query policies, that requires creating a file config in daemon runtime directory. See daemon/README.md for more information about interacting with CLI and configuration file options, or visit https://knot-resolver.readthedocs.io online documentation.
# Create a basic forwarder configuration $ cat << EOF > config modules = { 'policy' } policy.add(policy.all(policy.FORWARD('192.168.1.1'))) $ kresd -a 127.0.0.1 -k root.keys EOF
The available CLI options are:
If the file does not exist, it will be automatically boostrapped from IANA using HTTPS protocol and warning that you need to to check the key before trusting it will be issued.
The file contains DNSKEY/DS records in presentation format, and is compatible with Unbound and BIND 9 root key files.
Default: "/usr/share/dns/root.key"
When socket-activated and supervised by systemd or the equivalent, kresd defaults to --forks=1, and must not be set to any other value. If you want multiple concurrent processes supervised in this way, they should be supervised independently (see kresd.systemd(7)).
kresd.systemd(7), https://knot-resolver.readthedocs.io
kresd developers are mentioned in the AUTHORS file in the distribution.
2019-01-10 | CZ.NIC |