Server Configuration
Full transparency about the deployed DNS infrastructure.
The anycast fleet is operated with BIND 9 from the Internet Systems Consortium (ISC) – the reference implementation of the DNS protocol. This page shows the production configuration: the views behind both services, the family filter (RPZ) and the fail-closed no-log setup.
Recursive Resolver
Resolution via the DNS hierarchy starting from the root servers, without an upstream provider.
DNSSEC Validation
Signatures are validated; answers only when the chain of trust is intact.
No Query Log
Regular DNS queries and query errors are not logged.
Anycast from AS218835
Three sites on the same addresses; sick nodes withdraw their prefixes automatically.
One process, two services
A single named process answers all four anycast addresses: two BIND views (unfiltered/filtered) are told apart via match-destinations by which address the query went to, and share one cache. BGP announcement is BIRD's job; a health check automatically withdraws a sick node's prefixes so clients reach the next healthy node.
Anycast via BIRD
Own prefixes from AS218835, health-check withdrawal per node — failures heal in routing.
Views, one cache
Open and family in one process (attach-cache) — the filter rewrites answers, never the cache.
Validation & privacy
DNSSEC validation (auto), strict QNAME minimisation, prefetch — and querylog no.
Hardening
minimal-any and minimal-responses, EDNS capped at 1232 bytes, response rate limiting.
The family filter: Response Policy Zone
The family service filters via a Response Policy Zone (RPZ), fed from the OISD NSFW list (~489,000 domains, licence: OISD/Stephan van Ruth). Blocked answers are rewritten; a local policy zone ahead of the feed serves as the allowlist against false positives and carries the monitoring canary.
OISD NSFW
Adult content — deliberately no ad, tracker or malware filtering.
Hourly updates
Conditional GET against nsfw.oisd.nl/rpz; checked for truncation, explosion and silent emptying.
Fail-closed
On any update error the last accepted list stays active — an empty filter would go unnoticed otherwise.
break-dnssec
The filter applies to DNSSEC queries too (DO bit); validating clients get SERVFAIL for blocked signed domains.
No-log, fail-closed
On the fleet, not-logging is built as a whitelist: every log category not explicitly allowed is dropped — including every category carrying client IPs or query names, and in particular the family filter's RPZ hits. Both locks were verified individually against a running BIND.
Honest limits: rndc recursing/dumpdb can write cache and client data to disk on operator command, the cache itself reflects what has been looked up, and the hosting providers see the traffic regardless of what we keep.