Knot DNS

Knot DNS is a high-performance authoritative-only DNS server developed by CZ.NIC (the registry operator for the .cz country code top-level domain) since 2011. Written entirely in C with a focus on performance and security, Knot DNS is specifically designed for authoritative DNS service (not recursive resolution), making it ideal for TLD operators, enterprise DNS, and hosting providers. As of 2026, Knot DNS powers several country code top-level domains and handles millions of queries per second. Key features include: high-performance multi-threaded architecture with a query processing pipeline optimized for modern multi-core CPUs, support for all major DNS record types and EDNS extensions, DNSSEC with Online Signing (automatic zone signing and key management without pre-signed zones, supporting NSEC and NSEC3 with configurable algorithms including ECDSAP256SHA256, ECDSAP384SHA384, ED25519, and ED448), automatic key rollover with KASP (Key and Signature Policy), response Rate Limiting (RRL), Query Name Minimisation for outgoing queries, zone catalog zones (RFC 9432) for automatic zone provisioning, semantic zone checks during loading, remote control via the knotc utility (supporting zone reload, flush, sign, and statistics queries), a JSON statistics interface, module system for extending query processing (query modules can modify DNS responses, implement DNS-based authentication, and run Lua scripts via the synthrecord module for dynamic record generation), support for DNS-over-TLS and DNS-over-HTTPS on the authoritative side, catalog zones for automated secondary provisioning, and online DNSSEC signing with Hardware Security Module (HSM) support via PKCS#11. Knot DNS is licensed under GPL-3.0.