As a developer you also need DNS, maybe even more than most people, but certainly in more difficult situations. You're on a train or in a hotel room, and due to lousy WiFi or non-existant 4G coverage, you can't work on or test the app you're writing. In this talk we'll discuss how you can set up a lightweight DNS resolver on your workstation which you use in daily life and for your special situation. Rest assured, the word DNSSEC is sure to be used at least once.

1. DNS for Developers
Jan-Piet Mens
April 2016
@jpmens

2. @jpmens: consultant,
author, architect, part-time
admin, small-scale fiddler,
loves DNS, MQTT,
plain text.Thought up
OwnTracks, and made jo.

3. a selection of open
source DNS servers
authoritative or
recursive (or both) for
developers

5. /etc/hosts
ENODNS, authoritative, IPv4, IPv6, no DNSSEC ;-)

6. hostess
“because editing /etc/hosts by hand is a pain” ?
https://github.com/cbednarski/hostess
hostess add local.example.org 127.0.0.2
hostess del ww.example.org
hostess off local.example.com

7. dnsmasq
recursive, authoritative for /etc/hosts, DHCP (v4, v6),
DNSSEC validation

8. Unbound
local-data, DNSSEC, dnssec-trigger, +win32, embeddable,
fast, rate-limiting, extensible with Python, qname minimization

9. local-data
local-zone: "example.org." static
local-data: "beamer.example.org. IN A 192.168.1.22"
local-data: 'drink.example.org. TXT "Tonic!"'
local-data-ptr: "192.168.1.12 beamer.example.org"
$ dig +short @127.0.0.1 drink.example.org txt
"Tonic!"

10. Unbound local-data
$ dig +short @127.0.0.1 www.google.com
216.58.211.4
$ unbound-control local_data 'www.google.com A 127.0.0.69'
ok
$ dig +short @127.0.0.1 www.google.com
127.0.0.69

11. dnssec-trigger
DNSSEC, monitors changes to DHCP, reconfigures
Unbound, forwards to caches, fallback to auths or
NLnetLabs via TCP/443

12. NSD 4
very fast,TSIG + DNSSEC, zone compiler, root,
addzone/delzone, and RRL

13. BIND
full reference implementation,TSIG, DNSSEC, +win32, SDB,
DLZ, RFC 2136, ram-hungry, RPZ, views, RRL

14. PowerDNS
authoritative
lots of back-ends (SQL, LDAP, pipe), DNSSEC, master/slave/
native, supermaster, pdnsutil

15. PowerDNS Recursor
local zones, serves /etc/hosts, DNSSEC validation, fast,
monitoring, Lua

16. Knot
master/slave,AXFR/IXFR, RFC 2136, addzone,
reconfiguration, DNSSEC signing, RRL

17. Knot DNS Resolver
DNSSEC, NTA, Lua, RFC 5011, {memcached|Redis}-backed
cache, Graphite, etcd

18. mens.de/:/book

19. It's not always a fscking
DNS problem.

20. dnssexy.net
dig it!